Stage bounded typed source8 canonical and subtree writers

.gitattributes

@@ -15,93 +15,35 @@
 
 # Exact source/recovery oracles and archived ledgers retain their measured bytes.
 # Keep ordinary text diffs; only disable checkout/check-in newline conversion.
+PROJECT_GOAL.md -text whitespace=cr-at-eol
 harness/fixtures/release1-native/** -text
 harness/fixtures/interface-operation-probe/** -text
 harness/history/2026-09-06-ledgers-before-consolidation/** -text
+harness/history/2026-09-10-ledgers-before-continuation-refresh/** -text
 harness/history/2026-09-10-ledgers-before-second-consolidation/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
 harness/experiments/textual-authoring-20260911-local/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
-harness/experiments/constructor-defaults-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
-harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
-harness/experiments/behavior-creation-native-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
-harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol
-harness/experiments/textual-authoring-20260911/** -text whitespace=cr-at-eol
-harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whitespace=-blank-at-eol,cr-at-eol
-harness/fixtures/scenario-authoring/base/** -text whitespace=cr-at-eol
 crates/oa-desktop/src/recovery/fixtures/*.json -text
+crates/oa-core/src/analysis_numeric/fixtures/** -text whitespace=cr-at-eol
 harness/fixtures/source7-native/** -text
 harness/fixtures/basic-editing/** -text
+harness/fixtures/scenario-authoring/base/** -text whitespace=cr-at-eol
+harness/experiments/textual-authoring-20260911/** -text whitespace=cr-at-eol
+harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol
+harness/experiments/analysis-baseline-20260911/** -text whitespace=cr-at-eol
+harness/experiments/library-compatibility-20260911/** -text whitespace=cr-at-eol
+harness/experiments/refined-contracts-review-20260911/** -text whitespace=cr-at-eol
 harness/behavior-creation-contract.rs -text whitespace=cr-at-eol
 harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol
-harness/experiments/authoring-prerelease-20260911/** -text whitespace=cr-at-eol
-harness/experiments/cli-packaging-20260911/** -text whitespace=cr-at-eol
-harness/experiments/cli-prerelease-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-native-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-reopen-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-native-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-layout-reboot-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-source-layout-reboot-20260911/run-gates2.ps1 whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-20260911/**/*.log whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/scenario-native-local-20260911/** -text whitespace=cr-at-eol
-harness/experiments/scenario-native-local-20260911/**/*.log whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/scenario-native-local-20260911/**/*.arcadia whitespace=-blank-at-eol,cr-at-eol
-harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
-harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
 
 # Preserve checksum-bound font notices verbatim through Git round trips.
-harness/experiments/wsl-capacity-20260911/** -text whitespace=cr-at-eol
-harness/experiments/wsl-postboot-9e8r6t-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-layout-postboot-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-layout-verified-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-layout-full-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
 scripts/windows-notices/GNOME-Cantarell-61362600e104-COPYING -text
 scripts/windows-notices/Fira-OFL.txt -text
 scripts/windows-notices/FiraSans-Regular-NOTICE.txt -text
-harness/experiments/contextual-source-recovery-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-machine-v2-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-lifeline-v2-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-lifeline-v2-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-machine-v2-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/contextual-source-reopen-20260911/launch-method.ps1 whitespace=-blank-at-eof,cr-at-eol
-# Raw compact.exe output includes CR-CR-LF and incidental trailing spaces.
-harness/experiments/wsl-capacity-20260911/*.log -whitespace
-harness/experiments/contextual-prerelease-20260911/** -text whitespace=cr-at-eol
-harness/experiments/contextual-prerelease-publication-20260911/** -text whitespace=cr-at-eol
-harness/history/2026-09-11-state-before-gitea-migration/** -text whitespace=cr-at-eol
-harness/experiments/contextual-prerelease-20260911/native/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
-harness/experiments/contextual-prerelease-20260911/producer/package*.log whitespace=-blank-at-eof,cr-at-eol
-harness/experiments/contextual-prerelease-20260911/producer/source-push.log -whitespace
-harness/experiments/source-alias-rename-native-20260912/** -text whitespace=cr-at-eol
-harness/experiments/source-alias-rename-completed-20260912/** -text whitespace=cr-at-eol
-harness/experiments/source-alias-rename-refresh-20260912/** -text whitespace=cr-at-eol
-harness/experiments/source-alias-rename-native-closure-20260912/** -text whitespace=cr-at-eol
-# Preserve Text-workspace input, native and review evidence at its recorded bytes.
-harness/experiments/text-workspace-initial-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-workspace-initial-review-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-find-selection-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-workspace-native2-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-workspace-followup-review-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-workspace-native3-20260913/** -text whitespace=cr-at-eol
-# These checksum-bound baseline/expected fixtures deliberately end with blank lines.
-harness/experiments/text-workspace-native2-20260913/fixtures/**/*.arcadia whitespace=-blank-at-eof,cr-at-eol
-# Captured process streams retain intentional blank lines and diagnostic spacing.
-harness/experiments/text-find-selection-20260913/**/*.log -whitespace
-harness/experiments/text-workspace-initial-20260913/**/*.log -whitespace
-harness/experiments/text-workspace-native2-20260913/**/*.log -whitespace
-harness/experiments/text-workspace-native3-20260913/**/*.log -whitespace
-# Preserve the pinned dependency and diagnostic verification records verbatim.
-crates/vendor/iced_widget/** -text whitespace=cr-at-eol
-harness/experiments/text-diagnostics-20260913/** -text whitespace=cr-at-eol
-harness/experiments/text-diagnostics-20260913/**/*.log -whitespace
-# Preserve default-omission failure evidence and captured input manifests verbatim.
-harness/experiments/default-omission-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-omission-20260913/**/*.log -whitespace
-harness/experiments/default-admission-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-admission-20260913/**/*.log -whitespace
-harness/experiments/default-policy-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-policy-20260913/**/*.log -whitespace
-harness/experiments/default-fidelity-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-fidelity-20260913/**/*.log -whitespace
-harness/experiments/default-production-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-followup-20260913/** -text whitespace=cr-at-eol
-harness/experiments/default-consumers-20260913/** -text whitespace=cr-at-eol
+harness/experiments/behavior-creation-native-20260911/** -text whitespace=cr-at-eol
+harness/experiments/constructor-defaults-20260911/** -text whitespace=cr-at-eol
+harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/release-scenario-native-9e8r6t-20260911.md -text whitespace=cr-at-eol
+
+# Preserve the independently reviewed codec handoff bytes.
+harness/release-analysis-codec-implementation-20260911.md -text whitespace=-blank-at-eof,cr-at-eol

AGENTS.md

@@ -35,26 +35,26 @@ Use Gitea for live coordination and the relevant code version for implementation
 
 ## Coordination and integration
 
-All independent agents coordinating through Gitea run on completely separate machines, each with its own clone, filesystem, tools, processes, and runtime. Gitea and pushed Git history are the shared communication and delivery channels. Local files (including `harness`), unpushed commits, worktrees, test results, and localhost services are not accessible to peers. Matching branch names or paths do not imply synchronized contents.
-
 1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
-2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository/branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
-3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration/release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files/interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
-4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
-5. Follow project review and merge conventions. Fetch the relevant remote branches and inspect the identified commits before reviewing or integrating another machine's work. Resolve conflicts while preserving others' edits, and verify the combined result locally; report material environment differences. Local instruction-file edits reach peers only after publication and retrieval. Do not overwrite others' work or force-push shared history to resolve coordination problems.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, branch/worktree, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work. Record one integration/release owner when a milestone needs shared coordination. Use separate worktrees or checkouts, partition files/interfaces, and coordinate changes to shared specifications and documents.
+4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and uncommitted or unpublished work; make required artifacts accessible to other sessions. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+5. Follow project review and merge conventions. Inspect upstream changes, resolve conflicts while preserving others' edits, and verify the combined result. Do not overwrite others' work or force-push shared history to resolve coordination problems.
 6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
 
 Use Gitea MCP for shared coordination. If unavailable, report the failure, buffer necessary handoff information locally, and continue already-owned or clearly non-overlapping work. Reconcile with current Gitea state when access returns; do not claim an ownership update, review, or publication succeeded without confirmation.
 
 ## Delegation and reasoning
 
-Use GPT-6 Astra exclusively. Gitea peers are independent remote sessions, not subagents controlled by this session. Spawned subagents use the execution environment actually provided by the agent tools; do not assume they share files, and publish their results before Gitea peers need them. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
+Use GPT-6 Astra exclusively. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
 
 Optimize reasoning effort for verified outcomes per cost, including review, retries, and repair:
 
-- Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
-- Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
-- Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
+Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
+
+Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
+
+Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
 
 Allocate by task difficulty and consequences, not role or length alone. Start higher when a clearly difficult decision has expensive downstream consequences. Escalate for concrete reasoning difficulties; resolve missing evidence or unclear requirements at their source. Set subagent effort explicitly through supported controls to avoid unintended inheritance. Do not claim an unapplied change or alter global configuration merely to enforce these preferences.
 

Cargo.lock

@@ -65,6 +65,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "ar_archive_writer"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
+dependencies = [
+ "object",
+]
+
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -1567,6 +1576,8 @@ dependencies = [
 [[package]]
 name = "iced_widget"
 version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1596afa0d3109c2618e8bc12bae6c11d3064df8f95c42dfce570397dbe957ab"
 dependencies = [
  "iced_renderer",
  "log",
@@ -2105,6 +2116,25 @@ dependencies = [
  "jni-sys 0.3.1",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2151,9 +2181,13 @@ name = "oa-core"
 version = "0.2.0"
 dependencies = [
  "libc",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
  "same-file",
  "serde",
  "serde_json",
+ "stacker",
  "tempfile",
  "thiserror 2.0.20",
  "uuid",
@@ -2174,7 +2208,6 @@ dependencies = [
  "serde_json",
  "tempfile",
  "tokio",
- "unicode-segmentation",
 ]
 
 [[package]]
@@ -2485,6 +2518,15 @@ dependencies = [
  "objc2-foundation 0.2.2",
 ]
 
+[[package]]
+name = "object"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2708,6 +2750,16 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
 
+[[package]]
+name = "psm"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@@ -3428,6 +3480,19 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "stacker"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"

Cargo.toml

@@ -1,11 +1,7 @@
 [workspace]
 members = ["crates/oa-core", "crates/oa-desktop", "crates/oa-server", "crates/oa-cli"]
-exclude = ["crates/vendor/iced_widget"]
 resolver = "2"
 
-[patch.crates-io]
-iced_widget = { path = "crates/vendor/iced_widget" }
-
 [workspace.package]
 version = "0.2.0"
 edition = "2024"

crates/oa-cli/src/lib.rs

@@ -222,8 +222,8 @@ pub fn prepare(entry: &Path, operation: Operation) -> Result<Prepared, Box<Repor
         Box::new(report.clone())
     })?;
     let raw = snapshot.reachable_bundle();
-    // Keep discovery/IO failures that lint cannot recover from the bundle alone.
-    // Recompute source diagnostics below, against the same original bytes.
+    // The loader may include warnings from stabilized compilation. Only its
+    // discovery/IO diagnostics are authoritative on the original bytes.
     let mut diagnostics: Vec<_> = snapshot
         .diagnostics
         .iter()

crates/oa-core/Cargo.toml

@@ -7,11 +7,15 @@ rust-version.workspace = true
 
 [dependencies]
 serde.workspace = true
-serde_json.workspace = true
+serde_json = { workspace = true, features = ["unbounded_depth"] }
+stacker = "0.1.25"
 uuid.workspace = true
 thiserror.workspace = true
 tempfile = "3"
 same-file = "1"
+num-bigint = "0.5.1"
+num-integer = "0.1.47"
+num-traits = "0.2.19"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"

crates/oa-core/src/analysis.rs

@@ -0,0 +1,58 @@
+//! Schema 8 engineering definitions and static admission. No expression evaluation.
+mod admission;
+mod expression_lifecycle;
+pub(crate) mod expression_serde;
+pub mod references;
+mod resolve;
+mod typecheck;
+mod types;
+
+pub(crate) use admission::admit_structure_checked;
+pub use admission::{AdmissionLimits, AdmissionUsage, admit};
+pub use resolve::{EffectiveBinding, KindHandle, ResolvedAnalysis, ResolvedScalar, ResolvedType};
+pub use types::*;
+
+/// Ratified semantic bounds. Aggregate admission work is a separate caller policy.
+pub const MAX_EXPRESSION_DEPTH: usize = 128;
+pub const MAX_CLOSURE_NODES: usize = 65_536;
+pub const MAX_LIST_LENGTH: usize = 1_024;
+pub const MAX_CALL_DEPTH: usize = 32;
+
+/// Additional persisted records for existing transport ParseLimits. Definitions
+/// themselves count as graph objects there; this counts parameters, overrides,
+/// and every stored expression node, with saturating arithmetic and no recursion.
+pub(crate) fn nested_record_count(project: &crate::Project) -> usize {
+    let mut count = 0usize;
+    fn binding(value: &Binding, count: &mut usize) {
+        if let Binding::Expression(expression) = value {
+            references::walk(expression, &mut |_| {
+                *count = count.saturating_add(1);
+            });
+        }
+    }
+    for definition in project.definitions.values() {
+        if let DefinitionBody::Calculation(calculation) = &definition.body {
+            count = count.saturating_add(calculation.parameters.len());
+            binding(&calculation.body, &mut count);
+        }
+    }
+    for element in project.elements.values() {
+        match element.shared() {
+            Some(crate::SharedBody::EngineeringProperty { base, .. }) => binding(base, &mut count),
+            Some(crate::SharedBody::AnalysisCase { overrides, .. }) => {
+                count = count.saturating_add(overrides.len());
+                for value in overrides.values() {
+                    binding(value, &mut count);
+                }
+            }
+            Some(crate::SharedBody::AnalysisCheck { predicate, .. }) => {
+                binding(predicate, &mut count)
+            }
+            _ => {}
+        }
+    }
+    count
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/analysis/expression_lifecycle.rs

@@ -0,0 +1,377 @@
+//! Ordinary expression ownership never consumes stack proportional to tree depth.
+//! This also covers a partially decoded expression and rejected programmatic input.
+use super::Expr;
+use std::{fmt, mem};
+
+impl Expr {
+    fn clone_shell(&self) -> Self {
+        let leaf = || Box::new(Self::Boolean(false));
+        match self {
+            Self::Boolean(value) => Self::Boolean(*value),
+            Self::Number(value) => Self::Number(value.clone()),
+            Self::Quantity { magnitude, unit } => Self::Quantity {
+                magnitude: magnitude.clone(),
+                unit: *unit,
+            },
+            Self::Property(id) => Self::Property(*id),
+            Self::Parameter(id) => Self::Parameter(*id),
+            Self::List(values) => {
+                Self::List((0..values.len()).map(|_| Self::Boolean(false)).collect())
+            }
+            Self::Unary { op, .. } => Self::Unary {
+                op: *op,
+                operand: leaf(),
+            },
+            Self::Binary { op, .. } => Self::Binary {
+                op: *op,
+                left: leaf(),
+                right: leaf(),
+            },
+            Self::If { .. } => Self::If {
+                condition: leaf(),
+                when_true: leaf(),
+                when_false: leaf(),
+            },
+            Self::Call {
+                definition,
+                arguments,
+            } => Self::Call {
+                definition: *definition,
+                arguments: arguments
+                    .keys()
+                    .map(|id| (*id, Self::Boolean(false)))
+                    .collect(),
+            },
+            Self::Sum { .. } => Self::Sum {
+                values: leaf(),
+                initial: leaf(),
+            },
+            Self::Power { exponent, .. } => Self::Power {
+                base: leaf(),
+                exponent: *exponent,
+            },
+            Self::AsKind { kind, .. } => Self::AsKind {
+                kind: *kind,
+                value: leaf(),
+            },
+        }
+    }
+
+    fn detach_children(&mut self, pending: &mut Vec<Self>) {
+        let mut take = |child: &mut Box<Self>| {
+            pending.push(mem::replace(child.as_mut(), Self::Boolean(false)));
+        };
+        match self {
+            Self::Unary { operand, .. } => take(operand),
+            Self::Binary { left, right, .. } => {
+                take(left);
+                take(right);
+            }
+            Self::If {
+                condition,
+                when_true,
+                when_false,
+            } => {
+                take(condition);
+                take(when_true);
+                take(when_false);
+            }
+            Self::Sum { values, initial } => {
+                take(values);
+                take(initial);
+            }
+            Self::Power { base, .. } => take(base),
+            Self::AsKind { value, .. } => take(value),
+            Self::List(values) => pending.append(values),
+            Self::Call { arguments, .. } => {
+                pending.extend(mem::take(arguments).into_values());
+            }
+            Self::Boolean(_)
+            | Self::Number(_)
+            | Self::Quantity { .. }
+            | Self::Property(_)
+            | Self::Parameter(_) => {}
+        }
+    }
+}
+
+impl Drop for Expr {
+    fn drop(&mut self) {
+        let mut pending = Vec::new();
+        self.detach_children(&mut pending);
+        while let Some(mut node) = pending.pop() {
+            node.detach_children(&mut pending);
+            // node now owns only leaves/empty collections. Its ordinary drop
+            // reenters this method at most once, independently of original depth.
+        }
+    }
+}
+
+impl Clone for Expr {
+    fn clone(&self) -> Self {
+        let mut result = Self::Boolean(false);
+        let mut pending = vec![(self, &mut result)];
+        while let Some((source, destination)) = pending.pop() {
+            *destination = source.clone_shell();
+            match (source, destination) {
+                (Self::List(a), Self::List(b)) => pending.extend(a.iter().zip(b.iter_mut())),
+                (Self::Unary { operand: a, .. }, Self::Unary { operand: b, .. })
+                | (Self::Power { base: a, .. }, Self::Power { base: b, .. })
+                | (Self::AsKind { value: a, .. }, Self::AsKind { value: b, .. }) => {
+                    pending.push((a, b));
+                }
+                (
+                    Self::Binary {
+                        left: a, right: b, ..
+                    },
+                    Self::Binary {
+                        left: c, right: d, ..
+                    },
+                )
+                | (
+                    Self::Sum {
+                        values: a,
+                        initial: b,
+                    },
+                    Self::Sum {
+                        values: c,
+                        initial: d,
+                    },
+                ) => {
+                    pending.push((a, c));
+                    pending.push((b, d));
+                }
+                (
+                    Self::If {
+                        condition: a,
+                        when_true: b,
+                        when_false: c,
+                    },
+                    Self::If {
+                        condition: d,
+                        when_true: e,
+                        when_false: f,
+                    },
+                ) => {
+                    pending.push((a, d));
+                    pending.push((b, e));
+                    pending.push((c, f));
+                }
+                (Self::Call { arguments: a, .. }, Self::Call { arguments: b, .. }) => {
+                    pending.extend(a.values().zip(b.values_mut()));
+                }
+                _ => {}
+            }
+        }
+        result
+    }
+}
+
+impl PartialEq for Expr {
+    fn eq(&self, other: &Self) -> bool {
+        let mut pending = vec![(self, other)];
+        while let Some((a, b)) = pending.pop() {
+            match (a, b) {
+                (Self::Boolean(a), Self::Boolean(b)) if a == b => {}
+                (Self::Number(a), Self::Number(b)) if a == b => {}
+                (
+                    Self::Quantity {
+                        magnitude: a,
+                        unit: b,
+                    },
+                    Self::Quantity {
+                        magnitude: c,
+                        unit: d,
+                    },
+                ) if a == c && b == d => {}
+                (Self::Property(a), Self::Property(b)) if a == b => {}
+                (Self::Parameter(a), Self::Parameter(b)) if a == b => {}
+                (Self::List(a), Self::List(b)) if a.len() == b.len() => {
+                    pending.extend(a.iter().zip(b.iter()));
+                }
+                (Self::Unary { op: a, operand: b }, Self::Unary { op: c, operand: d })
+                    if a == c =>
+                {
+                    pending.push((b, d));
+                }
+                (
+                    Self::Binary {
+                        op: a,
+                        left: b,
+                        right: c,
+                    },
+                    Self::Binary {
+                        op: d,
+                        left: e,
+                        right: f,
+                    },
+                ) if a == d => {
+                    pending.push((b, e));
+                    pending.push((c, f));
+                }
+                (
+                    Self::If {
+                        condition: a,
+                        when_true: b,
+                        when_false: c,
+                    },
+                    Self::If {
+                        condition: d,
+                        when_true: e,
+                        when_false: f,
+                    },
+                ) => {
+                    pending.push((a, d));
+                    pending.push((b, e));
+                    pending.push((c, f));
+                }
+                (
+                    Self::Call {
+                        definition: a,
+                        arguments: b,
+                    },
+                    Self::Call {
+                        definition: c,
+                        arguments: d,
+                    },
+                ) if a == c && b.len() == d.len() => {
+                    for ((key_a, value_a), (key_b, value_b)) in b.iter().zip(d.iter()) {
+                        if key_a != key_b {
+                            return false;
+                        }
+                        pending.push((value_a, value_b));
+                    }
+                }
+                (
+                    Self::Sum {
+                        values: a,
+                        initial: b,
+                    },
+                    Self::Sum {
+                        values: c,
+                        initial: d,
+                    },
+                ) => {
+                    pending.push((a, c));
+                    pending.push((b, d));
+                }
+                (
+                    Self::Power {
+                        base: a,
+                        exponent: b,
+                    },
+                    Self::Power {
+                        base: c,
+                        exponent: d,
+                    },
+                ) if b == d => {
+                    pending.push((a, c));
+                }
+                (Self::AsKind { kind: a, value: b }, Self::AsKind { kind: c, value: d })
+                    if a == c =>
+                {
+                    pending.push((b, d));
+                }
+                _ => return false,
+            }
+        }
+        true
+    }
+}
+impl Eq for Expr {}
+
+impl fmt::Debug for Expr {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        enum Task<'a> {
+            Node(&'a Expr),
+            Text(&'static str),
+            Scalar(&'a dyn fmt::Debug),
+        }
+        use Task::*;
+        let mut pending = vec![Node(self)];
+        while let Some(task) = pending.pop() {
+            match task {
+                Text(text) => f.write_str(text)?,
+                Scalar(value) => write!(f, "{value:?}")?,
+                Node(node) => match node {
+                    Self::Boolean(value) => write!(f, "Boolean({value:?})")?,
+                    Self::Number(value) => write!(f, "Number({value:?})")?,
+                    Self::Quantity { magnitude, unit } => {
+                        write!(f, "Quantity {{ magnitude: {magnitude:?}, unit: {unit:?} }}")?;
+                    }
+                    Self::Property(id) => write!(f, "Property({id:?})")?,
+                    Self::Parameter(id) => write!(f, "Parameter({id:?})")?,
+                    Self::List(values) => {
+                        f.write_str("List([")?;
+                        pending.push(Text("])"));
+                        for (index, value) in values.iter().enumerate().rev() {
+                            pending.push(Node(value));
+                            if index > 0 {
+                                pending.push(Text(", "));
+                            }
+                        }
+                    }
+                    Self::Unary { op, operand } => {
+                        write!(f, "Unary {{ op: {op:?}, operand: ")?;
+                        pending.extend([Text(" }"), Node(operand)]);
+                    }
+                    Self::Binary { op, left, right } => {
+                        write!(f, "Binary {{ op: {op:?}, left: ")?;
+                        pending.extend([Text(" }"), Node(right), Text(", right: "), Node(left)]);
+                    }
+                    Self::If {
+                        condition,
+                        when_true,
+                        when_false,
+                    } => {
+                        f.write_str("If { condition: ")?;
+                        pending.extend([
+                            Text(" }"),
+                            Node(when_false),
+                            Text(", when_false: "),
+                            Node(when_true),
+                            Text(", when_true: "),
+                            Node(condition),
+                        ]);
+                    }
+                    Self::Call {
+                        definition,
+                        arguments,
+                    } => {
+                        write!(f, "Call {{ definition: {definition:?}, arguments: {{")?;
+                        pending.push(Text("} }"));
+                        for (index, (id, value)) in arguments.iter().enumerate().rev() {
+                            pending.extend([Node(value), Text(": "), Scalar(id)]);
+                            if index > 0 {
+                                pending.push(Text(", "));
+                            }
+                        }
+                    }
+                    Self::Sum { values, initial } => {
+                        f.write_str("Sum { values: ")?;
+                        pending.extend([
+                            Text(" }"),
+                            Node(initial),
+                            Text(", initial: "),
+                            Node(values),
+                        ]);
+                    }
+                    Self::Power { base, exponent } => {
+                        f.write_str("Power { base: ")?;
+                        pending.extend([
+                            Text(" }"),
+                            Scalar(exponent),
+                            Text(", exponent: "),
+                            Node(base),
+                        ]);
+                    }
+                    Self::AsKind { kind, value } => {
+                        write!(f, "AsKind {{ kind: {kind:?}, value: ")?;
+                        pending.extend([Text(" }"), Node(value)]);
+                    }
+                },
+            }
+        }
+        Ok(())
+    }
+}

crates/oa-core/src/analysis/expression_serde.rs

@@ -0,0 +1,261 @@
+//! The existing externally tagged Serde schema, with admission at each Expr edge.
+//! The private remote derive is the sole wire grammar: it still rejects unknown
+//! fields/variants, duplicate fields and malformed UUIDs/Exact values.
+use super::{
+    BinaryOp, DefinitionRef, Expr, MAX_CLOSURE_NODES, MAX_EXPRESSION_DEPTH, MAX_LIST_LENGTH,
+    ParameterId, UnaryOp,
+};
+use crate::{Id, analysis_numeric::Exact};
+use serde::{
+    Deserialize, Serialize,
+    de::{DeserializeSeed, MapAccess, SeqAccess, Visitor},
+};
+use std::{cell::Cell, collections::BTreeMap, fmt};
+
+pub(crate) const MAX_JSON_EXPRESSION_NODES: usize = 262_144;
+// These are requested segment capacities, not an allocator or RSS guarantee.
+const RED_ZONE: usize = 64 * 1024;
+const STACK_SEGMENT: usize = 512 * 1024;
+
+pub(crate) fn with_stack<R>(operation: impl FnOnce() -> R) -> R {
+    stacker::maybe_grow(RED_ZONE, STACK_SEGMENT, operation)
+}
+
+#[derive(Clone, Copy)]
+struct Meter {
+    active: bool,
+    depth: usize,
+    nodes: usize,
+    tree_nodes: usize,
+    maximum: usize,
+}
+impl Meter {
+    const DEFAULT: Self = Self {
+        active: false,
+        depth: 0,
+        nodes: 0,
+        tree_nodes: 0,
+        maximum: MAX_JSON_EXPRESSION_NODES,
+    };
+}
+thread_local! {
+    static DECODING: Cell<Meter> = const { Cell::new(Meter::DEFAULT) };
+    static ENCODING: Cell<Meter> = const { Cell::new(Meter::DEFAULT) };
+}
+type LocalMeter = &'static std::thread::LocalKey<Cell<Meter>>;
+
+/// One codec operation owns the aggregate meter across all disjoint bindings.
+/// Scope restoration also runs on errors and unwinding; no mutable TLS borrow is
+/// held across Serde/user code or a stack switch.
+pub(crate) struct Scope {
+    local: LocalMeter,
+    previous: Meter,
+}
+impl Scope {
+    pub(crate) fn decoding(maximum: usize) -> Self {
+        Self::new(&DECODING, maximum)
+    }
+    pub(crate) fn encoding(maximum: usize) -> Self {
+        Self::new(&ENCODING, maximum)
+    }
+    fn new(local: LocalMeter, maximum: usize) -> Self {
+        let next = Meter {
+            active: true,
+            maximum: maximum.min(MAX_JSON_EXPRESSION_NODES),
+            ..Meter::DEFAULT
+        };
+        let previous = local.with(|meter| meter.replace(next));
+        Self { local, previous }
+    }
+}
+impl Drop for Scope {
+    fn drop(&mut self) {
+        self.local.with(|meter| meter.set(self.previous));
+    }
+}
+
+struct NodeGuard {
+    local: LocalMeter,
+    root: bool,
+}
+impl NodeGuard {
+    fn enter(local: LocalMeter) -> Result<Self, &'static str> {
+        local.with(|slot| {
+            let mut meter = slot.get();
+            let root = !meter.active;
+            if root {
+                meter = Meter {
+                    active: true,
+                    ..Meter::DEFAULT
+                };
+            }
+            if meter.depth == 0 {
+                meter.tree_nodes = 0;
+            }
+            if meter.depth >= MAX_EXPRESSION_DEPTH {
+                return Err("Expression logical depth exceeds 128.");
+            }
+            if meter.nodes >= meter.maximum {
+                return Err("JSON expression allocation count exceeded.");
+            }
+            if meter.tree_nodes >= MAX_CLOSURE_NODES {
+                return Err("Stored expression node count exceeds 65536.");
+            }
+            meter.depth += 1;
+            meter.nodes += 1;
+            meter.tree_nodes += 1;
+            slot.set(meter);
+            Ok(Self { local, root })
+        })
+    }
+}
+impl Drop for NodeGuard {
+    fn drop(&mut self) {
+        self.local.with(|slot| {
+            let mut meter = slot.get();
+            meter.depth -= 1;
+            if self.root {
+                meter.active = false;
+            }
+            slot.set(meter);
+        });
+    }
+}
+
+impl<'de> Deserialize<'de> for Expr {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let _node = NodeGuard::enter(&DECODING).map_err(serde::de::Error::custom)?;
+        with_stack(|| WireExpr::deserialize(deserializer))
+    }
+}
+impl Serialize for Expr {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let _node = NodeGuard::enter(&ENCODING).map_err(serde::ser::Error::custom)?;
+        match self {
+            Self::List(values) if values.len() > MAX_LIST_LENGTH => {
+                return Err(serde::ser::Error::custom(
+                    "Expression List exceeds 1024 items.",
+                ));
+            }
+            Self::Call { arguments, .. } if arguments.len() > MAX_CLOSURE_NODES => {
+                return Err(serde::ser::Error::custom(
+                    "Call argument count exceeds 65536.",
+                ));
+            }
+            _ => {}
+        }
+        with_stack(|| WireExpr::serialize(self, serializer))
+    }
+}
+
+// A private remote derive avoids exposing an unguarded inherent deserialize on
+// public Expr. Children remain Expr, so every recursive edge enters the guard.
+#[derive(Serialize, Deserialize)]
+#[serde(remote = "Expr", deny_unknown_fields)]
+enum WireExpr {
+    Boolean(bool),
+    Number(Exact),
+    Quantity {
+        magnitude: Exact,
+        unit: DefinitionRef,
+    },
+    Property(Id),
+    Parameter(ParameterId),
+    List(#[serde(deserialize_with = "bounded_list")] Vec<Expr>),
+    Unary {
+        op: UnaryOp,
+        operand: Box<Expr>,
+    },
+    Binary {
+        op: BinaryOp,
+        left: Box<Expr>,
+        right: Box<Expr>,
+    },
+    If {
+        condition: Box<Expr>,
+        when_true: Box<Expr>,
+        when_false: Box<Expr>,
+    },
+    Call {
+        definition: DefinitionRef,
+        #[serde(deserialize_with = "bounded_arguments")]
+        arguments: BTreeMap<ParameterId, Expr>,
+    },
+    Sum {
+        values: Box<Expr>,
+        initial: Box<Expr>,
+    },
+    Power {
+        base: Box<Expr>,
+        exponent: i8,
+    },
+    AsKind {
+        kind: DefinitionRef,
+        value: Box<Expr>,
+    },
+}
+
+struct ListItem {
+    allowed: bool,
+}
+impl<'de> DeserializeSeed<'de> for ListItem {
+    type Value = Expr;
+    fn deserialize<D: serde::Deserializer<'de>>(self, deserializer: D) -> Result<Expr, D::Error> {
+        if !self.allowed {
+            return Err(serde::de::Error::custom(
+                "Expression List exceeds 1024 items.",
+            ));
+        }
+        Expr::deserialize(deserializer)
+    }
+}
+fn bounded_list<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<Vec<Expr>, D::Error> {
+    struct ListVisitor;
+    impl<'de> Visitor<'de> for ListVisitor {
+        type Value = Vec<Expr>;
+        fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            f.write_str("at most 1024 expression items")
+        }
+        fn visit_seq<A: SeqAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
+            let mut values = Vec::new();
+            while let Some(value) = access.next_element_seed(ListItem {
+                allowed: values.len() < MAX_LIST_LENGTH,
+            })? {
+                values.push(value);
+            }
+            Ok(values)
+        }
+    }
+    deserializer.deserialize_seq(ListVisitor)
+}
+fn bounded_arguments<'de, D: serde::Deserializer<'de>>(
+    deserializer: D,
+) -> Result<BTreeMap<ParameterId, Expr>, D::Error> {
+    struct Arguments;
+    impl<'de> Visitor<'de> for Arguments {
+        type Value = BTreeMap<ParameterId, Expr>;
+        fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            f.write_str("unique scoped parameter UUID keys")
+        }
+        fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Self::Value, A::Error> {
+            let mut values = BTreeMap::new();
+            while let Some(id) = access.next_key::<ParameterId>()? {
+                if values.contains_key(&id) {
+                    return Err(serde::de::Error::custom(format!(
+                        "Duplicate parameter ID {}",
+                        id.0
+                    )));
+                }
+                if values.len() >= MAX_CLOSURE_NODES {
+                    return Err(serde::de::Error::custom(
+                        "Call argument count exceeds 65536.",
+                    ));
+                }
+                // Count/duplicate checks precede construction of the next subtree.
+                values.insert(id, access.next_value()?);
+            }
+            Ok(values)
+        }
+    }
+    deserializer.deserialize_map(Arguments)
+}

crates/oa-core/src/analysis/references.rs

@@ -0,0 +1,246 @@
+//! Typed live reference domains; parameter IDs and opaque historical captures are separate.
+use super::*;
+use crate::{Element, Id, Project, SharedBody};
+use std::collections::BTreeSet;
+
+pub fn expression_properties(expression: &Expr) -> BTreeSet<Id> {
+    let mut found = BTreeSet::new();
+    walk(expression, &mut |node| {
+        if let Expr::Property(id) = node {
+            found.insert(*id);
+        }
+    });
+    found
+}
+pub fn expression_definitions(expression: &Expr) -> BTreeSet<Id> {
+    let mut found = BTreeSet::new();
+    walk(expression, &mut |node| match node {
+        Expr::Quantity { unit, .. } => {
+            found.insert(unit.local());
+        }
+        Expr::Call { definition, .. } => {
+            found.insert(definition.local());
+        }
+        Expr::AsKind { kind, .. } => {
+            found.insert(kind.local());
+        }
+        _ => {}
+    });
+    found
+}
+pub(crate) fn walk<'a>(expression: &'a Expr, visit: &mut impl FnMut(&'a Expr)) {
+    let mut pending = vec![expression];
+    while let Some(node) = pending.pop() {
+        visit(node);
+        match node {
+            Expr::List(items) => pending.extend(items.iter().rev()),
+            Expr::Unary { operand, .. } => pending.push(operand),
+            Expr::Binary { left, right, .. } => {
+                pending.push(right);
+                pending.push(left);
+            }
+            Expr::If {
+                condition,
+                when_true,
+                when_false,
+            } => {
+                pending.push(when_false);
+                pending.push(when_true);
+                pending.push(condition);
+            }
+            Expr::Call { arguments, .. } => pending.extend(arguments.values().rev()),
+            Expr::Sum { values, initial } => {
+                pending.push(values);
+                pending.push(initial);
+            }
+            Expr::Power { base, .. } => pending.push(base),
+            Expr::AsKind { value, .. } => pending.push(value),
+            _ => {}
+        }
+    }
+}
+fn walk_mut(expression: &mut Expr, visit: &mut impl FnMut(&mut Expr)) {
+    let mut pending = vec![expression];
+    while let Some(node) = pending.pop() {
+        visit(node);
+        match node {
+            Expr::List(items) => pending.extend(items.iter_mut()),
+            Expr::Unary { operand, .. } => pending.push(operand),
+            Expr::Binary { left, right, .. } => {
+                pending.push(left);
+                pending.push(right);
+            }
+            Expr::If {
+                condition,
+                when_true,
+                when_false,
+            } => {
+                pending.push(condition);
+                pending.push(when_true);
+                pending.push(when_false);
+            }
+            Expr::Call { arguments, .. } => pending.extend(arguments.values_mut()),
+            Expr::Sum { values, initial } => {
+                pending.push(values);
+                pending.push(initial);
+            }
+            Expr::Power { base, .. } => pending.push(base),
+            Expr::AsKind { value, .. } => pending.push(value),
+            _ => {}
+        }
+    }
+}
+pub fn element_model_references(element: &Element) -> BTreeSet<Id> {
+    let mut result = BTreeSet::new();
+    let mut binding = |value: &Binding| {
+        if let Binding::Expression(expression) = value {
+            result.extend(expression_properties(expression));
+        }
+    };
+    match element.shared() {
+        Some(SharedBody::EngineeringProperty { base, .. }) => binding(base),
+        Some(SharedBody::AnalysisCase { overrides, .. }) => {
+            for value in overrides.values() {
+                binding(value);
+            }
+        }
+        Some(SharedBody::AnalysisCheck { predicate, .. }) => binding(predicate),
+        _ => {}
+    }
+    match element.shared() {
+        Some(SharedBody::EngineeringProperty { subject, .. }) => {
+            result.insert(subject.id());
+        }
+        Some(SharedBody::AnalysisCase {
+            subject, overrides, ..
+        }) => {
+            result.extend(subject.map(AnalysisSubject::id));
+            result.extend(overrides.keys());
+        }
+        Some(SharedBody::AnalysisCheck {
+            subject,
+            documented_constraint,
+            ..
+        }) => {
+            result.extend(subject.map(AnalysisSubject::id));
+            result.extend(documented_constraint);
+        }
+        _ => {}
+    }
+    result
+}
+fn remap_ref(reference: &mut DefinitionRef, old: Id, new: Id) {
+    let DefinitionRef::Local(id) = reference;
+    if *id == old {
+        *id = new;
+    }
+}
+fn remap_type(value: &mut AnalysisType, old: Id, new: Id) {
+    let (AnalysisType::Scalar(scalar) | AnalysisType::List(scalar)) = value;
+    if let ScalarType::Quantity(reference) = scalar {
+        remap_ref(reference, old, new);
+    }
+}
+fn remap_binding(value: &mut Binding, old: Id, new: Id) {
+    if let Binding::Expression(expression) = value {
+        walk_mut(expression, &mut |node| match node {
+            Expr::Property(id) if *id == old => *id = new,
+            Expr::Quantity { unit, .. } => remap_ref(unit, old, new),
+            Expr::Call { definition, .. } => remap_ref(definition, old, new),
+            Expr::AsKind { kind, .. } => remap_ref(kind, old, new),
+            _ => {} // Parameter nodes and argument keys are scoped, never global.
+        });
+    }
+}
+fn remap_subject(subject: &mut AnalysisSubject, old: Id, new: Id) {
+    let (AnalysisSubject::Element(id) | AnalysisSubject::Relation(id)) = subject;
+    if *id == old {
+        *id = new;
+    }
+}
+
+/// Check before any mutation so a map-key collision never silently discards a binding.
+pub(crate) fn check_remap(project: &Project, old: Id, new: Id) -> Result<(), AnalysisError> {
+    if old != new {
+        for element in project.elements.values() {
+            if let Some(SharedBody::AnalysisCase { overrides, .. }) = element.shared()
+                && overrides.contains_key(&old)
+                && overrides.contains_key(&new)
+            {
+                return Err(AnalysisError::new(
+                    element.id,
+                    "overrides",
+                    "analysis_reference_collision",
+                    "Reidentification would merge two distinct override keys.",
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn remap_project(project: &mut Project, old: Id, new: Id) {
+    for element in project.elements.values_mut() {
+        match element.shared_mut() {
+            Some(SharedBody::EngineeringProperty {
+                subject,
+                value_type,
+                display_unit,
+                base,
+            }) => {
+                remap_subject(subject, old, new);
+                remap_type(value_type, old, new);
+                if let Some(reference) = display_unit {
+                    remap_ref(reference, old, new);
+                }
+                remap_binding(base, old, new);
+            }
+            Some(SharedBody::AnalysisCase {
+                subject, overrides, ..
+            }) => {
+                if let Some(subject) = subject {
+                    remap_subject(subject, old, new);
+                }
+                if old != new
+                    && let Some(value) = overrides.remove(&old)
+                {
+                    overrides.insert(new, value);
+                }
+                for value in overrides.values_mut() {
+                    remap_binding(value, old, new);
+                }
+            }
+            Some(SharedBody::AnalysisCheck {
+                subject,
+                documented_constraint,
+                predicate,
+            }) => {
+                if let Some(subject) = subject {
+                    remap_subject(subject, old, new);
+                }
+                if *documented_constraint == Some(old) {
+                    *documented_constraint = Some(new);
+                }
+                remap_binding(predicate, old, new);
+            }
+            _ => {}
+        }
+    }
+    for definition in project.definitions.values_mut() {
+        match &mut definition.body {
+            DefinitionBody::QuantityKind(QuantityKindDefinition {
+                algebra: QuantityAlgebra::Affine { difference },
+                ..
+            }) => remap_ref(difference, old, new),
+            DefinitionBody::Unit(unit) => remap_ref(&mut unit.kind, old, new),
+            DefinitionBody::Calculation(calculation) => {
+                for parameter in &mut calculation.parameters {
+                    remap_type(&mut parameter.value_type, old, new);
+                }
+                remap_type(&mut calculation.result, old, new);
+                remap_binding(&mut calculation.body, old, new);
+            }
+            _ => {}
+        }
+    }
+}

crates/oa-core/src/analysis/resolve.rs

@@ -0,0 +1,146 @@
+use super::*;
+use crate::analysis_numeric::{NumericType, ResolvedKind, Unit};
+use crate::{Id, Project, SharedBody};
+use std::collections::BTreeMap;
+
+/// Bounded local nominal origin; no rooted graph is cloned during arithmetic.
+/// Full ResolvedKind equality additionally includes dimension/algebra/difference.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct KindHandle {
+    model: Id,
+    definition: Id,
+}
+impl KindHandle {
+    pub fn definition(self) -> Id {
+        self.definition
+    }
+    pub(crate) fn local(model: Id, definition: Id) -> Self {
+        Self { model, definition }
+    }
+}
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ResolvedScalar {
+    Boolean,
+    Numeric(NumericType<KindHandle>),
+}
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ResolvedType {
+    Scalar(ResolvedScalar),
+    List(ResolvedScalar),
+}
+impl ResolvedType {
+    pub(crate) fn boolean() -> Self {
+        Self::Scalar(ResolvedScalar::Boolean)
+    }
+    pub(crate) fn numeric(value: NumericType<KindHandle>) -> Self {
+        Self::Scalar(ResolvedScalar::Numeric(value.normalized()))
+    }
+}
+#[derive(Debug, Clone, Copy)]
+pub struct EffectiveBinding<'a> {
+    pub binding: &'a Binding,
+    pub origin: BindingOrigin,
+}
+
+/// Constructed only by admission; exact source/capture provenance stays with its owner.
+/// Values from different accepted environments must not be mixed by an evaluator.
+pub struct ResolvedAnalysis<'p> {
+    pub(super) project: &'p Project,
+    pub(super) kinds: BTreeMap<Id, ResolvedKind<KindHandle>>,
+    pub(super) units: BTreeMap<Id, Unit<KindHandle>>,
+    pub(super) limits: AdmissionLimits,
+    pub(super) usage: AdmissionUsage,
+}
+impl<'p> ResolvedAnalysis<'p> {
+    pub fn project(&self) -> &'p Project {
+        self.project
+    }
+    pub fn admission_usage(&self) -> AdmissionUsage {
+        self.usage
+    }
+    pub fn admission_limits(&self) -> AdmissionLimits {
+        self.limits
+    }
+    pub fn definition(&self, reference: DefinitionRef) -> Option<&'p Definition> {
+        self.project.definitions.get(&reference.local())
+    }
+    pub fn kind(&self, reference: DefinitionRef) -> Option<&ResolvedKind<KindHandle>> {
+        self.kinds.get(&reference.local())
+    }
+    pub fn unit(&self, reference: DefinitionRef) -> Option<&Unit<KindHandle>> {
+        self.units.get(&reference.local())
+    }
+    pub fn calculation(&self, reference: DefinitionRef) -> Option<&'p CalculationDefinition> {
+        match &self.definition(reference)?.body {
+            DefinitionBody::Calculation(value) => Some(value),
+            _ => None,
+        }
+    }
+    pub fn declared_type(&self, value: &AnalysisType) -> Option<ResolvedType> {
+        let (AnalysisType::Scalar(scalar) | AnalysisType::List(scalar)) = value;
+        let scalar = match scalar {
+            ScalarType::Boolean => ResolvedScalar::Boolean,
+            ScalarType::Number => ResolvedScalar::Numeric(NumericType::Number),
+            ScalarType::Quantity(reference) => {
+                ResolvedScalar::Numeric(NumericType::Named(self.kind(*reference)?.clone()))
+            }
+        };
+        Some(match value {
+            AnalysisType::Scalar(_) => ResolvedType::Scalar(scalar),
+            AnalysisType::List(_) => ResolvedType::List(scalar),
+        })
+    }
+    pub fn effective_binding(
+        &self,
+        property: Id,
+        context: EvaluationContext,
+    ) -> Result<EffectiveBinding<'p>, AnalysisError> {
+        let element = self.project.elements.get(&property).ok_or_else(|| {
+            AnalysisError::new(
+                property,
+                "context",
+                "analysis_property",
+                "Property does not exist.",
+            )
+        })?;
+        let Some(SharedBody::EngineeringProperty { base, .. }) = element.shared() else {
+            return Err(AnalysisError::new(
+                property,
+                "context",
+                "analysis_property",
+                "Target is not an engineering property.",
+            ));
+        };
+        if let EvaluationContext::Case(id) = context {
+            let case = self.project.elements.get(&id).ok_or_else(|| {
+                AnalysisError::new(id, "context", "analysis_case", "Case does not exist.")
+            })?;
+            let Some(SharedBody::AnalysisCase { overrides, .. }) = case.shared() else {
+                return Err(AnalysisError::new(
+                    id,
+                    "context",
+                    "analysis_case",
+                    "Context is not an analysis case.",
+                ));
+            };
+            if case.layer() != element.layer() {
+                return Err(AnalysisError::new(
+                    id,
+                    "context",
+                    "analysis_layer",
+                    "Case and property must share a layer.",
+                ));
+            }
+            if let Some(binding) = overrides.get(&property) {
+                return Ok(EffectiveBinding {
+                    binding,
+                    origin: BindingOrigin::CaseOverride(id),
+                });
+            }
+        }
+        Ok(EffectiveBinding {
+            binding: base,
+            origin: BindingOrigin::ModelBaseline,
+        })
+    }
+}

crates/oa-core/src/analysis/typecheck.rs

@@ -0,0 +1,458 @@
+//! Static expression checking shares numeric operator algebra with execution.
+use super::admission::Budget;
+use super::*;
+use crate::analysis_numeric::{NumericError, NumericType, ResolvedKind};
+use crate::{Id, Layer, SharedBody};
+use std::collections::BTreeMap;
+
+pub(super) struct BindingContext<'a> {
+    pub owner: Id,
+    pub field: &'a str,
+    pub layer: Option<Layer>,
+    pub parameters: &'a BTreeMap<ParameterId, ResolvedType>,
+}
+
+pub(super) fn binding(
+    environment: &ResolvedAnalysis<'_>,
+    context: BindingContext<'_>,
+    value: &Binding,
+    expected: &ResolvedType,
+    budget: &mut Budget,
+) -> Result<(), AnalysisError> {
+    if let Binding::Expression(expression) = value {
+        let mut checker = Checker {
+            environment,
+            owner: context.owner,
+            field: context.field,
+            layer: context.layer,
+            parameters: context.parameters,
+            budget,
+        };
+        checker.expression(expression, Some(expected))?;
+    }
+    Ok(())
+}
+
+struct Checker<'a, 'p, 'b> {
+    environment: &'a ResolvedAnalysis<'p>,
+    owner: Id,
+    field: &'a str,
+    layer: Option<Layer>,
+    parameters: &'a BTreeMap<ParameterId, ResolvedType>,
+    budget: &'b mut Budget,
+}
+
+/// One suspended expression per logical depth. No Expr is owned or cloned by
+/// a frame, and every stored type/nominal handle has fixed, nonrecursive size.
+struct Frame<'e, 'p> {
+    expression: &'e Expr,
+    expected: Option<ResolvedType>,
+    state: State<'p>,
+}
+
+enum State<'p> {
+    Enter,
+    Unary,
+    BinaryLeft,
+    BinaryRight(ResolvedType),
+    IfCondition,
+    IfTrue,
+    IfFalse(ResolvedType),
+    List {
+        next: usize,
+    },
+    Call {
+        calculation: &'p CalculationDefinition,
+        next: usize,
+    },
+    SumInitial,
+    SumValues(ResolvedType),
+    Power,
+    AsKind(ResolvedKind<KindHandle>),
+}
+
+enum Step<'e> {
+    Child(&'e Expr, Option<ResolvedType>),
+    Complete(ResolvedType),
+}
+
+impl<'p> Checker<'_, 'p, '_> {
+    fn error(&self, code: &str, message: impl Into<String>) -> AnalysisError {
+        AnalysisError::new(self.owner, self.field, code, message)
+    }
+    fn numeric(&self, value: ResolvedType) -> Result<NumericType<KindHandle>, AnalysisError> {
+        match value {
+            ResolvedType::Scalar(ResolvedScalar::Numeric(value)) => Ok(value),
+            _ => Err(self.error("analysis_type", "A scalar numeric operand is required.")),
+        }
+    }
+    fn operation(
+        &self,
+        result: Result<NumericType<KindHandle>, NumericError>,
+    ) -> Result<ResolvedType, AnalysisError> {
+        result
+            .map(ResolvedType::numeric)
+            .map_err(|error| self.error("analysis_type", error.to_string()))
+    }
+
+    /// Explicit continuations replace Rust recursion. Width never expands the
+    /// frame stack: lists and calls schedule only their next ordered child.
+    /// At most 128 frames and one returned scalar/list type are retained. The
+    /// per-node/per-argument meter charges remain identical to recursive entry;
+    /// continuation steps do constant bounded work within those charges.
+    fn expression(
+        &mut self,
+        expression: &Expr,
+        expected: Option<&ResolvedType>,
+    ) -> Result<ResolvedType, AnalysisError> {
+        let mut frames = Vec::with_capacity(MAX_EXPRESSION_DEPTH);
+        frames.push(Frame {
+            expression,
+            expected: expected.cloned(),
+            state: State::Enter,
+        });
+        let mut returned = None;
+        loop {
+            let frame = frames.last_mut().expect("active expression frame");
+            match self.advance(frame, returned.take())? {
+                Step::Child(expression, expected) => {
+                    if frames.len() == MAX_EXPRESSION_DEPTH {
+                        // Preserve entry charging/error precedence without ever
+                        // allocating the rejected 129th frame.
+                        self.budget.charge(self.owner, self.field, 1)?;
+                        return Err(self.error(
+                            "analysis_depth",
+                            "Expression exceeds the logical depth limit.",
+                        ));
+                    }
+                    frames.push(Frame {
+                        expression,
+                        expected,
+                        state: State::Enter,
+                    });
+                }
+                Step::Complete(actual) => {
+                    let frame = frames.pop().expect("completed expression frame");
+                    let expected = frame.expected.as_ref();
+                    if expected.is_some_and(|expected| expected != &actual) {
+                        return Err(self.error(
+                            "analysis_type",
+                            format!("Expected {expected:?}; expression has {actual:?}."),
+                        ));
+                    }
+                    if frames.is_empty() {
+                        return Ok(actual);
+                    }
+                    returned = Some(actual);
+                }
+            }
+        }
+    }
+
+    fn advance<'e>(
+        &mut self,
+        frame: &mut Frame<'e, 'p>,
+        returned: Option<ResolvedType>,
+    ) -> Result<Step<'e>, AnalysisError> {
+        let state = std::mem::replace(&mut frame.state, State::Enter);
+        if let State::Enter = state {
+            self.budget.charge(self.owner, self.field, 1)?;
+            return self.enter(frame);
+        }
+        let child = returned.expect("continuation follows a completed child");
+        match state {
+            State::Enter => unreachable!("handled before consuming child"),
+            State::Unary => {
+                let Expr::Unary { op, .. } = frame.expression else {
+                    unreachable!()
+                };
+                Ok(Step::Complete(match op {
+                    UnaryOp::Not => ResolvedType::boolean(),
+                    UnaryOp::Negate | UnaryOp::Absolute => {
+                        self.operation(self.numeric(child)?.unary_result())?
+                    }
+                }))
+            }
+            State::BinaryLeft => {
+                let Expr::Binary { right, .. } = frame.expression else {
+                    unreachable!()
+                };
+                frame.state = State::BinaryRight(child);
+                Ok(Step::Child(right, None))
+            }
+            State::BinaryRight(left) => {
+                let Expr::Binary { op, .. } = frame.expression else {
+                    unreachable!()
+                };
+                Ok(Step::Complete(self.binary(*op, left, child)?))
+            }
+            State::IfCondition => {
+                let Expr::If { when_true, .. } = frame.expression else {
+                    unreachable!()
+                };
+                frame.state = State::IfTrue;
+                Ok(Step::Child(when_true, frame.expected.clone()))
+            }
+            State::IfTrue => {
+                let Expr::If { when_false, .. } = frame.expression else {
+                    unreachable!()
+                };
+                frame.state = State::IfFalse(child.clone());
+                Ok(Step::Child(when_false, Some(child)))
+            }
+            State::IfFalse(value) => Ok(Step::Complete(value)),
+            State::List { next } => {
+                let ResolvedType::Scalar(scalar) = child else {
+                    return Err(self.error(
+                        "analysis_list",
+                        "Lists are flat; nested lists are not admitted.",
+                    ));
+                };
+                let Expr::List(items) = frame.expression else {
+                    unreachable!()
+                };
+                if let Some(item) = items.get(next) {
+                    frame.state = State::List { next: next + 1 };
+                    Ok(Step::Child(item, Some(ResolvedType::Scalar(scalar))))
+                } else {
+                    Ok(Step::Complete(ResolvedType::List(scalar)))
+                }
+            }
+            State::Call { calculation, next } => self.call_argument(frame, calculation, next),
+            State::SumInitial => {
+                let numeric = self.numeric(child.clone())?;
+                self.operation(numeric.unary_result())?;
+                let ResolvedType::Scalar(scalar) = &child else {
+                    unreachable!()
+                };
+                let expected = ResolvedType::List(scalar.clone());
+                let Expr::Sum { values, .. } = frame.expression else {
+                    unreachable!()
+                };
+                frame.state = State::SumValues(child);
+                Ok(Step::Child(values, Some(expected)))
+            }
+            State::SumValues(initial) => {
+                let numeric = self.numeric(initial.clone())?;
+                self.operation(numeric.additive_result(&numeric, false))?;
+                Ok(Step::Complete(initial))
+            }
+            State::Power => {
+                let Expr::Power { exponent, .. } = frame.expression else {
+                    unreachable!()
+                };
+                Ok(Step::Complete(
+                    self.operation(self.numeric(child)?.power_result(*exponent))?,
+                ))
+            }
+            State::AsKind(kind) => Ok(Step::Complete(
+                self.operation(self.numeric(child)?.assertion_result(&kind))?,
+            )),
+        }
+    }
+
+    fn enter<'e>(&mut self, frame: &mut Frame<'e, 'p>) -> Result<Step<'e>, AnalysisError> {
+        let actual = match frame.expression {
+            Expr::Boolean(_) => ResolvedType::boolean(),
+            Expr::Number(_) => ResolvedType::numeric(NumericType::Number),
+            Expr::Quantity { unit, .. } => {
+                let unit = self.environment.unit(*unit).ok_or_else(|| {
+                    self.error(
+                        "analysis_unit",
+                        "Quantity literal must reference an existing unit definition.",
+                    )
+                })?;
+                ResolvedType::numeric(NumericType::Named(unit.kind().clone()))
+            }
+            Expr::Property(id) => {
+                let layer = self.layer.ok_or_else(|| {
+                    self.error(
+                        "analysis_purity",
+                        "Reusable calculations cannot capture project properties.",
+                    )
+                })?;
+                let element =
+                    self.environment.project.elements.get(id).ok_or_else(|| {
+                        self.error("analysis_property", "Property does not exist.")
+                    })?;
+                let Some(SharedBody::EngineeringProperty { value_type, .. }) = element.shared()
+                else {
+                    return Err(self.error(
+                        "analysis_property",
+                        "Reference must target an engineering property.",
+                    ));
+                };
+                if element.layer() != layer {
+                    return Err(self.error(
+                        "analysis_layer",
+                        "Property references must stay in the same layer.",
+                    ));
+                }
+                self.environment.declared_type(value_type).ok_or_else(|| {
+                    self.error("analysis_kind", "Declared property kind does not resolve.")
+                })?
+            }
+            Expr::Parameter(id) => self.parameters.get(id).cloned().ok_or_else(|| {
+                self.error(
+                    "analysis_parameter",
+                    "Parameter does not belong to this calculation definition.",
+                )
+            })?,
+            Expr::List(items) => {
+                if items.len() > MAX_LIST_LENGTH {
+                    return Err(
+                        self.error("analysis_list", "List exceeds the flat-list length limit.")
+                    );
+                }
+                let scalar = match &frame.expected {
+                    Some(ResolvedType::List(value)) => Some(value.clone()),
+                    _ => None,
+                };
+                if let Some(item) = items.first() {
+                    frame.state = State::List { next: 1 };
+                    return Ok(Step::Child(item, scalar.map(ResolvedType::Scalar)));
+                }
+                ResolvedType::List(scalar.ok_or_else(|| {
+                    self.error(
+                        "analysis_list",
+                        "An empty list requires an explicit surrounding list type.",
+                    )
+                })?)
+            }
+            Expr::Unary { op, operand } => {
+                frame.state = State::Unary;
+                let expected = (*op == UnaryOp::Not).then(ResolvedType::boolean);
+                return Ok(Step::Child(operand, expected));
+            }
+            Expr::Binary { left, .. } => {
+                frame.state = State::BinaryLeft;
+                return Ok(Step::Child(left, None));
+            }
+            Expr::If { condition, .. } => {
+                frame.state = State::IfCondition;
+                return Ok(Step::Child(condition, Some(ResolvedType::boolean())));
+            }
+            Expr::Call {
+                definition,
+                arguments,
+            } => {
+                let calculation = self.environment.calculation(*definition).ok_or_else(|| {
+                    self.error(
+                        "analysis_calculation",
+                        "Call must reference a calculation definition.",
+                    )
+                })?;
+                if arguments.len() != calculation.parameters.len() {
+                    return Err(self.error("analysis_arguments", "Call arguments must bind every declared parameter exactly once, by its scoped identity."));
+                }
+                // Charge the complete key scan before any parameter lookup.
+                self.budget
+                    .charge(self.owner, self.field, calculation.parameters.len() as u64)?;
+                if calculation
+                    .parameters
+                    .iter()
+                    .any(|parameter| !arguments.contains_key(&parameter.id))
+                {
+                    return Err(self.error("analysis_arguments", "Call arguments must bind every declared parameter exactly once, by its scoped identity."));
+                }
+                return self.call_argument(frame, calculation, 0);
+            }
+            Expr::Sum { initial, .. } => {
+                frame.state = State::SumInitial;
+                return Ok(Step::Child(initial, None));
+            }
+            Expr::Power { base, .. } => {
+                frame.state = State::Power;
+                return Ok(Step::Child(base, None));
+            }
+            Expr::AsKind { kind, value } => {
+                let kind = self
+                    .environment
+                    .kind(*kind)
+                    .ok_or_else(|| {
+                        self.error(
+                            "analysis_kind",
+                            "Kind assertion must reference a quantity kind.",
+                        )
+                    })?
+                    .clone();
+                frame.state = State::AsKind(kind);
+                return Ok(Step::Child(value, None));
+            }
+        };
+        Ok(Step::Complete(actual))
+    }
+
+    /// Arguments follow parameter declaration order, not UUID map order. Retain
+    /// the resolved calculation by reference and schedule one argument at a time.
+    fn call_argument<'e>(
+        &mut self,
+        frame: &mut Frame<'e, 'p>,
+        calculation: &'p CalculationDefinition,
+        next: usize,
+    ) -> Result<Step<'e>, AnalysisError> {
+        if let Some(parameter) = calculation.parameters.get(next) {
+            self.budget.charge(self.owner, self.field, 1)?;
+            let expected = self
+                .environment
+                .declared_type(&parameter.value_type)
+                .ok_or_else(|| self.error("analysis_kind", "Parameter kind does not resolve."))?;
+            let Expr::Call { arguments, .. } = frame.expression else {
+                unreachable!()
+            };
+            frame.state = State::Call {
+                calculation,
+                next: next + 1,
+            };
+            Ok(Step::Child(&arguments[&parameter.id], Some(expected)))
+        } else {
+            let result = self
+                .environment
+                .declared_type(&calculation.result)
+                .ok_or_else(|| {
+                    self.error("analysis_kind", "Calculation result kind does not resolve.")
+                })?;
+            Ok(Step::Complete(result))
+        }
+    }
+
+    fn binary(
+        &self,
+        op: BinaryOp,
+        left: ResolvedType,
+        right: ResolvedType,
+    ) -> Result<ResolvedType, AnalysisError> {
+        match op {
+            BinaryOp::And | BinaryOp::Or => {
+                if left != ResolvedType::boolean() || right != ResolvedType::boolean() {
+                    return Err(self.error("analysis_type", "Boolean operands are required."));
+                }
+                Ok(ResolvedType::boolean())
+            }
+            BinaryOp::Equal | BinaryOp::NotEqual
+                if left == ResolvedType::boolean() && right == ResolvedType::boolean() =>
+            {
+                Ok(ResolvedType::boolean())
+            }
+            BinaryOp::Equal
+            | BinaryOp::NotEqual
+            | BinaryOp::Less
+            | BinaryOp::LessOrEqual
+            | BinaryOp::Greater
+            | BinaryOp::GreaterOrEqual => {
+                self.numeric(left)?
+                    .comparison_compatible(&self.numeric(right)?)
+                    .map_err(|error| self.error("analysis_type", error.to_string()))?;
+                Ok(ResolvedType::boolean())
+            }
+            BinaryOp::Add | BinaryOp::Subtract => self.operation(
+                self.numeric(left)?
+                    .additive_result(&self.numeric(right)?, op == BinaryOp::Subtract),
+            ),
+            BinaryOp::Multiply | BinaryOp::Divide => self.operation(
+                self.numeric(left)?
+                    .multiplicative_result(&self.numeric(right)?, op == BinaryOp::Divide),
+            ),
+        }
+    }
+}

crates/oa-core/src/analysis/types.rs

@@ -0,0 +1,213 @@
+//! Persistent analysis vocabulary. This is part of Project, not an evaluation model.
+use crate::Id;
+use crate::analysis_numeric::{Dimension, Exact};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+/// Only real local definitions are admitted in schema 8's first environment.
+/// Imported references require the separately implemented pinned package catalog.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum DefinitionRef {
+    Local(Id),
+}
+impl DefinitionRef {
+    pub fn local(self) -> Id {
+        match self {
+            Self::Local(id) => id,
+        }
+    }
+}
+
+/// Qualified by its owning CalculationDefinition; never a global model identity.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct ParameterId(pub Id);
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Definition {
+    pub id: Id,
+    pub alias: String,
+    pub name: String,
+    pub description: String,
+    pub body: DefinitionBody,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum DefinitionBody {
+    QuantityKind(QuantityKindDefinition),
+    Unit(UnitDefinition),
+    Calculation(CalculationDefinition),
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct QuantityKindDefinition {
+    pub dimension: Dimension,
+    pub algebra: QuantityAlgebra,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum QuantityAlgebra {
+    Linear,
+    Affine { difference: DefinitionRef },
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UnitDefinition {
+    pub kind: DefinitionRef,
+    pub scale: Exact,
+    pub offset: Exact,
+    pub symbol: String,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum ScalarType {
+    Boolean,
+    Number,
+    Quantity(DefinitionRef),
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum AnalysisType {
+    Scalar(ScalarType),
+    List(ScalarType),
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Parameter {
+    pub id: ParameterId,
+    pub name: String,
+    pub value_type: AnalysisType,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CalculationDefinition {
+    pub parameters: Vec<Parameter>,
+    pub result: AnalysisType,
+    pub body: Binding,
+}
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum Binding {
+    Unbound,
+    Expression(Expr),
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum UnaryOp {
+    Negate,
+    Absolute,
+    Not,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum BinaryOp {
+    Add,
+    Subtract,
+    Multiply,
+    Divide,
+    Equal,
+    NotEqual,
+    Less,
+    LessOrEqual,
+    Greater,
+    GreaterOrEqual,
+    And,
+    Or,
+}
+pub enum Expr {
+    Boolean(bool),
+    Number(Exact),
+    Quantity {
+        magnitude: Exact,
+        unit: DefinitionRef,
+    },
+    Property(Id),
+    Parameter(ParameterId),
+    List(Vec<Expr>),
+    Unary {
+        op: UnaryOp,
+        operand: Box<Expr>,
+    },
+    Binary {
+        op: BinaryOp,
+        left: Box<Expr>,
+        right: Box<Expr>,
+    },
+    If {
+        condition: Box<Expr>,
+        when_true: Box<Expr>,
+        when_false: Box<Expr>,
+    },
+    Call {
+        definition: DefinitionRef,
+        arguments: BTreeMap<ParameterId, Expr>,
+    },
+    Sum {
+        values: Box<Expr>,
+        initial: Box<Expr>,
+    },
+    Power {
+        base: Box<Expr>,
+        exponent: i8,
+    },
+    AsKind {
+        kind: DefinitionRef,
+        value: Box<Expr>,
+    },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum AnalysisSubject {
+    Element(Id),
+    Relation(Id),
+}
+impl AnalysisSubject {
+    pub fn id(self) -> Id {
+        match self {
+            Self::Element(id) | Self::Relation(id) => id,
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum BaselineBase {
+    ModelBaseline,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum EvaluationContext {
+    ModelBaseline,
+    Case(Id),
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum BindingOrigin {
+    ModelBaseline,
+    CaseOverride(Id),
+}
+
+/// Located structural/static admission failure, not a false or failed evaluation.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, thiserror::Error)]
+#[serde(deny_unknown_fields)]
+#[error("{code} at {object}.{field}: {message}")]
+pub struct AnalysisError {
+    pub object: Id,
+    pub field: String,
+    pub code: String,
+    pub message: String,
+}
+impl AnalysisError {
+    pub(crate) fn new(
+        object: Id,
+        field: impl Into<String>,
+        code: &str,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            object,
+            field: field.into(),
+            code: code.into(),
+            message: message.into(),
+        }
+    }
+}

crates/oa-core/src/analysis_numeric.rs

@@ -0,0 +1,103 @@
+//! Exact numeric foundation for analysis; no model, expression, or package resolver.
+//!
+//! Values use reduced rational coordinates. All nontrivial arithmetic takes one
+//! request-local [WorkMeter]. The future evaluator must also charge *expanded*
+//! expression/call/property/list/target visits and retain the same logical walk on
+//! cache hits. Stored AST size is not a dynamic execution limit.
+//!
+//! Approximate engineering functions/irrational unit scales require a subsequent
+//! explicit numeric profile; rationals do not implement degree/radian conversion
+//! or transcendental mathematics.
+
+mod dimension;
+mod exact;
+mod meter;
+mod quantity;
+
+pub use dimension::{Dimension, DimensionAxis};
+pub use exact::{Exact, ExactWire};
+pub use meter::{
+    EvaluationStep, NumericOperation, WorkExhaustion, WorkLimits, WorkMeter, WorkResource,
+    WorkSite, WorkUsage,
+};
+pub use quantity::{NumericType, NumericValue, ResolvedKind, Unit};
+
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+/// Profile identity includes the accounting rules, not crate-internal timing.
+pub const WORK_PROFILE: &str = "Q1-logical-work-1";
+pub const MAX_COMPONENT_BITS: u64 = 4096;
+/// Cross products require 8192 bits; their sum can require one additional bit.
+pub const MAX_INTERMEDIATE_BITS: u64 = 8193;
+pub const MAX_COMPONENT_DIGITS: usize = 1234;
+pub const MAX_DECIMAL_EXPONENT: i32 = 128;
+pub const MAX_INTEGER_POWER: i8 = 16;
+/// Includes ratio punctuation/whitespace without permitting unbounded scanning.
+pub const MAX_LITERAL_BYTES: usize = 2 * MAX_COMPONENT_DIGITS + 32;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum NumberComponent {
+    Numerator,
+    Denominator,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
+pub enum NumericLimit {
+    #[error("request work exhausted: {0}")]
+    Work(WorkExhaustion),
+    #[error("{component:?} uses {bits} bits, above the {limit}-bit {stage} limit")]
+    Bits {
+        component: NumberComponent,
+        bits: u64,
+        limit: u64,
+        stage: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
+pub enum NumericError {
+    #[error("numeric limit: {0}")]
+    Limit(NumericLimit),
+    #[error("invalid numeric literal")]
+    InvalidLiteral,
+    #[error("numeric literal exceeds its digit or byte limit")]
+    LiteralTooLong,
+    #[error("decimal exponent is outside -128 through 128")]
+    DecimalExponent,
+    #[error("wire rational is not in canonical reduced form")]
+    NonCanonicalWire,
+    #[error("rational denominator is zero")]
+    ZeroDenominator,
+    #[error("division by zero")]
+    DivisionByZero,
+    #[error("zero to the power zero is undefined in this profile")]
+    ZeroPowerZero,
+    #[error("integer power is outside -16 through 16")]
+    IntegerPower,
+    #[error("dimension exponent at {axis:?} is outside -32 through 32: {value}")]
+    DimensionExponent { axis: DimensionAxis, value: i32 },
+    #[error("unit scale must be strictly positive")]
+    UnitScale,
+    #[error("a linear unit must have zero offset")]
+    LinearOffset,
+    #[error("an affine point must have a distinct linear difference kind")]
+    DifferenceKind,
+    #[error("numeric kinds or dimensions are incompatible")]
+    IncompatibleTypes,
+    #[error("operation is not defined for affine points")]
+    AffineOperation,
+    #[error("AsKind requires an anonymous matching dimension and a linear target")]
+    KindAssertion,
+    #[error("request work limits exceed the provisional reference ceilings")]
+    InvalidWorkLimits,
+}
+
+impl NumericError {
+    pub fn is_terminal_work_exhaustion(&self) -> bool {
+        matches!(self, Self::Limit(NumericLimit::Work(_)))
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/analysis_numeric/dimension.rs

@@ -0,0 +1,107 @@
+use super::NumericError;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DimensionAxis {
+    Length,
+    Mass,
+    Time,
+    ElectricCurrent,
+    Temperature,
+    Amount,
+    LuminousIntensity,
+}
+
+impl DimensionAxis {
+    pub const ALL: [Self; 7] = [
+        Self::Length,
+        Self::Mass,
+        Self::Time,
+        Self::ElectricCurrent,
+        Self::Temperature,
+        Self::Amount,
+        Self::LuminousIntensity,
+    ];
+}
+
+/// SI base-dimension vector in DimensionAxis::ALL order, each entry -32..=32.
+/// This is a dimension, never a nominal quantity-kind compatibility proof.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(try_from = "[i16; 7]", into = "[i16; 7]")]
+pub struct Dimension([i16; 7]);
+
+impl Dimension {
+    pub const ZERO: Self = Self([0; 7]);
+
+    pub fn new(exponents: [i16; 7]) -> Result<Self, NumericError> {
+        for (index, value) in exponents.iter().copied().enumerate() {
+            if !(-32..=32).contains(&value) {
+                return Err(NumericError::DimensionExponent {
+                    axis: DimensionAxis::ALL[index],
+                    value: i32::from(value),
+                });
+            }
+        }
+        Ok(Self(exponents))
+    }
+
+    pub fn exponents(self) -> [i16; 7] {
+        self.0
+    }
+
+    pub fn is_dimensionless(self) -> bool {
+        self == Self::ZERO
+    }
+
+    pub fn checked_product(self, rhs: Self) -> Result<Self, NumericError> {
+        self.combine(rhs, 1)
+    }
+
+    pub fn checked_quotient(self, rhs: Self) -> Result<Self, NumericError> {
+        self.combine(rhs, -1)
+    }
+
+    pub fn checked_power(self, exponent: i8) -> Result<Self, NumericError> {
+        if !(-super::MAX_INTEGER_POWER..=super::MAX_INTEGER_POWER).contains(&exponent) {
+            return Err(NumericError::IntegerPower);
+        }
+        let mut output = [0; 7];
+        for (index, value) in self.0.iter().enumerate() {
+            output[index] = Self::checked_exponent(index, i32::from(*value) * i32::from(exponent))?;
+        }
+        Ok(Self(output))
+    }
+
+    fn combine(self, rhs: Self, sign: i32) -> Result<Self, NumericError> {
+        let mut output = [0; 7];
+        for (index, value) in self.0.iter().enumerate() {
+            output[index] =
+                Self::checked_exponent(index, i32::from(*value) + sign * i32::from(rhs.0[index]))?;
+        }
+        Ok(Self(output))
+    }
+
+    fn checked_exponent(index: usize, value: i32) -> Result<i16, NumericError> {
+        if !(-32..=32).contains(&value) {
+            return Err(NumericError::DimensionExponent {
+                axis: DimensionAxis::ALL[index],
+                value,
+            });
+        }
+        Ok(value as i16)
+    }
+}
+
+impl TryFrom<[i16; 7]> for Dimension {
+    type Error = NumericError;
+
+    fn try_from(value: [i16; 7]) -> Result<Self, Self::Error> {
+        Self::new(value)
+    }
+}
+
+impl From<Dimension> for [i16; 7] {
+    fn from(value: Dimension) -> Self {
+        value.0
+    }
+}

crates/oa-core/src/analysis_numeric/exact.rs

@@ -0,0 +1,469 @@
+use super::meter::{normalization_cost, parse_cost, product_cost, sum_cost, words};
+use super::{
+    MAX_COMPONENT_BITS, MAX_COMPONENT_DIGITS, MAX_DECIMAL_EXPONENT, MAX_INTEGER_POWER,
+    MAX_INTERMEDIATE_BITS, MAX_LITERAL_BYTES, NumberComponent, NumericError, NumericLimit,
+    NumericOperation, WorkLimits, WorkMeter,
+};
+use num_bigint::BigInt;
+use num_integer::Integer;
+use num_traits::{One, Signed, Zero};
+use serde::{Deserialize, Serialize};
+use std::cmp::Ordering;
+
+/// The interchange representation deliberately does not use num-bigint's serde
+/// format or JSON numeric values. Duplicate/missing/unknown fields reject.
+/// Its derived decoder allocates String fields before numeric validation; a
+/// transport/document adapter must bound the encoded envelope and decoded text.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ExactWire {
+    pub numerator: String,
+    pub denominator: String,
+}
+
+/// Reduced rational with positive denominator and <=4096-bit components.
+///
+/// There are no unmetered arithmetic/ordering traits. Eq is structural equality
+/// of already normalized bounded values, not an expression comparison API.
+/// Standalone serde admission bounds the subsequent BigInt validation, not the
+/// preceding String decoding. Document adapters must bound encoded/decoded input
+/// and aggregate admission work. Evaluation uses one explicit WorkMeter.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "ExactWire", into = "ExactWire")]
+pub struct Exact {
+    numerator: BigInt,
+    denominator: BigInt,
+}
+
+impl Exact {
+    pub fn from_integer(value: i64) -> Self {
+        Self {
+            numerator: BigInt::from(value),
+            denominator: BigInt::one(),
+        }
+    }
+
+    pub fn is_zero(&self) -> bool {
+        self.numerator.is_zero()
+    }
+
+    pub fn is_positive(&self) -> bool {
+        self.numerator.is_positive()
+    }
+
+    pub fn component_bits(&self) -> (u64, u64) {
+        (self.numerator.bits(), self.denominator.bits())
+    }
+
+    pub fn to_wire(&self) -> ExactWire {
+        ExactWire {
+            numerator: self.numerator.to_string(),
+            denominator: self.denominator.to_string(),
+        }
+    }
+
+    /// Canonical *literal* spelling, not a generic expression formatter.
+    /// Negative literal nodes use ratio(-n,d), even when d=1. A leading minus
+    /// belongs to the future expression parser's UnaryNegate node instead.
+    pub fn canonical_literal(&self) -> String {
+        if self.denominator.is_one() && !self.numerator.is_negative() {
+            self.numerator.to_string()
+        } else {
+            format!("ratio({}, {})", self.numerator, self.denominator)
+        }
+    }
+
+    pub fn from_wire(wire: &ExactWire, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let n_digits = wire_digits(&wire.numerator, true)?;
+        let d_digits = wire_digits(&wire.denominator, false)?;
+        let n_bound = decimal_bits(n_digits.len());
+        let d_bound = decimal_bits(d_digits.len());
+        meter.numeric(
+            NumericOperation::ParseWire,
+            parse_cost(n_digits.len(), n_bound)
+                + parse_cost(d_digits.len(), d_bound)
+                + normalization_cost(n_bound, d_bound),
+        )?;
+        let numerator = parse_integer(&wire.numerator)?;
+        let denominator = parse_integer(&wire.denominator)?;
+        Self::check_bits(&numerator, &denominator, MAX_COMPONENT_BITS, "wire")?;
+        if denominator.is_zero() {
+            return Err(NumericError::ZeroDenominator);
+        }
+        if !numerator.gcd(&denominator).is_one() {
+            return Err(NumericError::NonCanonicalWire);
+        }
+        Ok(Self {
+            numerator,
+            denominator,
+        })
+    }
+
+    /// Reads one unsigned decimal/integer atom or a ratio(n,d) literal only.
+    /// It does not parse expressions, unary operators, units, calls or names.
+    /// Source ratios/decimals may reduce; wire values must already be canonical.
+    pub fn parse_literal(source: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        if source.len() > MAX_LITERAL_BYTES {
+            return Err(NumericError::LiteralTooLong);
+        }
+        let source = trim_ascii(source);
+        if let Some(body) = source.strip_prefix("ratio(") {
+            let body = body.strip_suffix(')').ok_or(NumericError::InvalidLiteral)?;
+            let (n, d) = body.split_once(',').ok_or(NumericError::InvalidLiteral)?;
+            return Self::parse_ratio(trim_ascii(n), trim_ascii(d), meter);
+        }
+        Self::parse_decimal(source, meter)
+    }
+
+    fn parse_ratio(n: &str, d: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        let n_digits = source_integer_digits(n, true)?;
+        let d_digits = source_integer_digits(d, false)?;
+        let n_bound = decimal_bits(n_digits.len());
+        let d_bound = decimal_bits(d_digits.len());
+        Self::check_estimates(n_bound, d_bound)?;
+        meter.numeric(
+            NumericOperation::ParseLiteral,
+            parse_cost(n_digits.len(), n_bound)
+                + parse_cost(d_digits.len(), d_bound)
+                + normalization_cost(n_bound, d_bound),
+        )?;
+        Self::normalize_precharged(parse_integer(n)?, parse_integer(d)?)
+    }
+
+    fn parse_decimal(source: &str, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        let mut parts = source.split(['e', 'E']);
+        let mantissa = parts.next().ok_or(NumericError::InvalidLiteral)?;
+        let exponent = match parts.next() {
+            Some(text) => parse_exponent(text)?,
+            None => 0,
+        };
+        if parts.next().is_some() {
+            return Err(NumericError::InvalidLiteral);
+        }
+        let (whole, fraction) = match mantissa.split_once('.') {
+            Some((whole, fraction)) if !fraction.is_empty() => (whole, fraction),
+            Some(_) => return Err(NumericError::InvalidLiteral),
+            None => (mantissa, ""),
+        };
+        source_integer_digits(whole, false)?;
+        if !fraction.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(NumericError::InvalidLiteral);
+        }
+        let digit_count = whole.len() + fraction.len();
+        if digit_count > MAX_COMPONENT_DIGITS {
+            return Err(NumericError::LiteralTooLong);
+        }
+        let adjustment = exponent - fraction.len() as i32;
+        let power = adjustment.unsigned_abs();
+        let mantissa_bound = decimal_bits(digit_count);
+        let scale_bound = decimal_bits(power as usize + 1);
+        let (n_bound, d_bound) = if adjustment >= 0 {
+            (mantissa_bound + scale_bound, 1)
+        } else {
+            (mantissa_bound, scale_bound)
+        };
+        Self::check_estimates(n_bound, d_bound)?;
+        // Fixed logical allowance for constructing 10^power; independent of
+        // num-bigint's selected multiplication/exponentiation implementation.
+        let power_steps = 1 + 2 * u64::from(u32::BITS - power.leading_zeros());
+        meter.numeric(
+            NumericOperation::ParseLiteral,
+            parse_cost(digit_count, mantissa_bound)
+                + power_steps * product_cost(scale_bound, scale_bound)
+                + product_cost(mantissa_bound, scale_bound)
+                + normalization_cost(n_bound, d_bound),
+        )?;
+        let digits = format!("{whole}{fraction}");
+        let mut numerator = parse_integer(&digits)?;
+        let scale = BigInt::from(10_u8).pow(power);
+        let denominator = if adjustment >= 0 {
+            numerator *= scale;
+            BigInt::one()
+        } else {
+            scale
+        };
+        Self::normalize_precharged(numerator, denominator)
+    }
+
+    pub fn add(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        self.add_or_subtract(rhs, false, meter)
+    }
+
+    pub fn subtract(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        self.add_or_subtract(rhs, true, meter)
+    }
+
+    fn add_or_subtract(
+        &self,
+        rhs: &Self,
+        subtract: bool,
+        meter: &mut WorkMeter,
+    ) -> Result<Self, NumericError> {
+        let (a, b) = self.component_bits();
+        let (c, d) = rhs.component_bits();
+        let left_bound = a + d;
+        let right_bound = c + b;
+        let n_bound = left_bound.max(right_bound) + 1;
+        let d_bound = b + d;
+        Self::check_estimates(n_bound, d_bound)?;
+        meter.numeric(
+            if subtract {
+                NumericOperation::Subtract
+            } else {
+                NumericOperation::Add
+            },
+            product_cost(a, d)
+                + product_cost(c, b)
+                + sum_cost(left_bound, right_bound)
+                + product_cost(b, d)
+                + normalization_cost(n_bound, d_bound),
+        )?;
+        let left = &self.numerator * &rhs.denominator;
+        let right = &rhs.numerator * &self.denominator;
+        let numerator = if subtract { left - right } else { left + right };
+        let denominator = &self.denominator * &rhs.denominator;
+        Self::normalize_precharged(numerator, denominator)
+    }
+
+    pub fn multiply(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        let (a, b) = self.component_bits();
+        let (c, d) = rhs.component_bits();
+        Self::check_estimates(a + c, b + d)?;
+        meter.numeric(
+            NumericOperation::Multiply,
+            product_cost(a, c) + product_cost(b, d) + normalization_cost(a + c, b + d),
+        )?;
+        Self::normalize_precharged(
+            &self.numerator * &rhs.numerator,
+            &self.denominator * &rhs.denominator,
+        )
+    }
+
+    pub fn divide(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        let (a, b) = self.component_bits();
+        let (c, d) = rhs.component_bits();
+        Self::check_estimates(a + d, b + c)?;
+        meter.numeric(
+            NumericOperation::Divide,
+            product_cost(a, d) + product_cost(b, c) + normalization_cost(a + d, b + c),
+        )?;
+        if rhs.is_zero() {
+            return Err(NumericError::DivisionByZero);
+        }
+        Self::normalize_precharged(
+            &self.numerator * &rhs.denominator,
+            &self.denominator * &rhs.numerator,
+        )
+    }
+
+    pub fn compare(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Ordering, NumericError> {
+        let (a, b) = self.component_bits();
+        let (c, d) = rhs.component_bits();
+        Self::check_estimates((a + d).max(c + b), 1)?;
+        meter.numeric(
+            NumericOperation::Compare,
+            product_cost(a, d) + product_cost(c, b) + sum_cost(a + d, c + b),
+        )?;
+        Ok((&self.numerator * &rhs.denominator).cmp(&(&rhs.numerator * &self.denominator)))
+    }
+
+    pub fn negated(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.numeric(NumericOperation::Negate, self.copy_cost())?;
+        Ok(Self {
+            numerator: -&self.numerator,
+            denominator: self.denominator.clone(),
+        })
+    }
+
+    pub fn absolute(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.numeric(NumericOperation::Absolute, self.copy_cost())?;
+        Ok(Self {
+            numerator: self.numerator.abs(),
+            denominator: self.denominator.clone(),
+        })
+    }
+
+    pub fn reciprocal(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.numeric(NumericOperation::Reciprocal, self.copy_cost())?;
+        if self.is_zero() {
+            return Err(NumericError::DivisionByZero);
+        }
+        Ok(Self {
+            numerator: if self.numerator.is_negative() {
+                -&self.denominator
+            } else {
+                self.denominator.clone()
+            },
+            denominator: self.numerator.abs(),
+        })
+    }
+
+    /// Fixed left-to-right repeated multiplication, at most 16 multiplications.
+    /// Each reduced stage obeys the same component bound; no large power is
+    /// allocated and subsequently discarded after discovering it is oversized.
+    pub fn power(&self, exponent: i8, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.numeric(NumericOperation::Power, self.copy_cost())?;
+        if !(-MAX_INTEGER_POWER..=MAX_INTEGER_POWER).contains(&exponent) {
+            return Err(NumericError::IntegerPower);
+        }
+        if self.is_zero() && exponent == 0 {
+            return Err(NumericError::ZeroPowerZero);
+        }
+        let factor = if exponent < 0 {
+            self.reciprocal(meter)?
+        } else {
+            self.clone()
+        };
+        let mut value = Self::from_integer(1);
+        for _ in 0..exponent.unsigned_abs() {
+            value = value.multiply(&factor, meter)?;
+        }
+        Ok(value)
+    }
+
+    pub(super) fn copy_cost(&self) -> u64 {
+        let (n, d) = self.component_bits();
+        1 + words(n) + words(d)
+    }
+
+    fn normalize_precharged(
+        mut numerator: BigInt,
+        mut denominator: BigInt,
+    ) -> Result<Self, NumericError> {
+        Self::check_bits(
+            &numerator,
+            &denominator,
+            MAX_INTERMEDIATE_BITS,
+            "intermediate",
+        )?;
+        if denominator.is_zero() {
+            return Err(NumericError::ZeroDenominator);
+        }
+        if denominator.is_negative() {
+            numerator = -numerator;
+            denominator = -denominator;
+        }
+        let gcd = numerator.gcd(&denominator);
+        numerator /= &gcd;
+        denominator /= gcd;
+        Self::check_bits(&numerator, &denominator, MAX_COMPONENT_BITS, "reduced")?;
+        Ok(Self {
+            numerator,
+            denominator,
+        })
+    }
+
+    fn check_estimates(n: u64, d: u64) -> Result<(), NumericError> {
+        Self::check_bit_count(
+            n,
+            NumberComponent::Numerator,
+            MAX_INTERMEDIATE_BITS,
+            "predicted",
+        )?;
+        Self::check_bit_count(
+            d,
+            NumberComponent::Denominator,
+            MAX_INTERMEDIATE_BITS,
+            "predicted",
+        )
+    }
+
+    fn check_bits(n: &BigInt, d: &BigInt, limit: u64, stage: &str) -> Result<(), NumericError> {
+        Self::check_bit_count(n.bits(), NumberComponent::Numerator, limit, stage)?;
+        Self::check_bit_count(d.bits(), NumberComponent::Denominator, limit, stage)
+    }
+
+    fn check_bit_count(
+        bits: u64,
+        component: NumberComponent,
+        limit: u64,
+        stage: &str,
+    ) -> Result<(), NumericError> {
+        if bits > limit {
+            return Err(NumericError::Limit(NumericLimit::Bits {
+                component,
+                bits,
+                limit,
+                stage: stage.to_owned(),
+            }));
+        }
+        Ok(())
+    }
+}
+
+impl TryFrom<ExactWire> for Exact {
+    type Error = NumericError;
+
+    fn try_from(value: ExactWire) -> Result<Self, Self::Error> {
+        // BigInt validation is bounded after ExactWire strings have decoded.
+        // The adapter owns envelope/text/aggregate admission bounds and must not
+        // reset evaluation meters.
+        Self::from_wire(&value, &mut WorkMeter::new(WorkLimits::REFERENCE))
+    }
+}
+
+impl From<Exact> for ExactWire {
+    fn from(value: Exact) -> Self {
+        value.to_wire()
+    }
+}
+
+fn trim_ascii(text: &str) -> &str {
+    text.trim_matches(|ch: char| ch.is_ascii_whitespace())
+}
+
+fn source_integer_digits(text: &str, signed: bool) -> Result<&str, NumericError> {
+    let digits = if signed {
+        text.strip_prefix('-').unwrap_or(text)
+    } else {
+        text
+    };
+    if digits.len() > MAX_COMPONENT_DIGITS {
+        return Err(NumericError::LiteralTooLong);
+    }
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(NumericError::InvalidLiteral);
+    }
+    Ok(digits)
+}
+
+fn wire_digits(text: &str, signed: bool) -> Result<&str, NumericError> {
+    let digits = source_integer_digits(text, signed).map_err(|error| match error {
+        NumericError::LiteralTooLong => error,
+        _ => NumericError::NonCanonicalWire,
+    })?;
+    if (digits.len() > 1 && digits.starts_with('0')) || (text.starts_with('-') && digits == "0") {
+        return Err(NumericError::NonCanonicalWire);
+    }
+    Ok(digits)
+}
+
+fn parse_integer(text: &str) -> Result<BigInt, NumericError> {
+    BigInt::parse_bytes(text.as_bytes(), 10).ok_or(NumericError::InvalidLiteral)
+}
+
+fn parse_exponent(text: &str) -> Result<i32, NumericError> {
+    let (negative, digits) = if let Some(digits) = text.strip_prefix('-') {
+        (true, digits)
+    } else {
+        (false, text.strip_prefix('+').unwrap_or(text))
+    };
+    if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(NumericError::InvalidLiteral);
+    }
+    let mut value = 0_i32;
+    for digit in digits.bytes() {
+        value = value * 10 + i32::from(digit - b'0');
+        if value > MAX_DECIMAL_EXPONENT {
+            return Err(NumericError::DecimalExponent);
+        }
+    }
+    Ok(if negative { -value } else { value })
+}
+
+fn decimal_bits(digits: usize) -> u64 {
+    // 3.322 exceeds log2(10); dimensions are bounded before this conversion.
+    (digits as u64 * 3322).div_ceil(1000).max(1)
+}

crates/oa-core/src/analysis_numeric/fixtures/r7-literal-boundaries.json

@@ -0,0 +1,32 @@
+[
+  {
+    "canonical_source": "1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+    "expression": {
+      "Number": {
+        "denominator": "1",
+        "numerator": "1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+      }
+    },
+    "name": "ten_to_300"
+  },
+  {
+    "canonical_source": "ratio(1, 522194440706576253345876355358312191289982124523691890192116741641976953985778728424413405967498779170445053357219631418993786719092896803631618043925682638972978488271854999170180795067191859157214035005927973113188159419698856372836167342172293308748403954352901852035642024370059304557233988891799014503343469488440893892973452815095130470299789726716411734651513348221529512507986199933857107770846917779942645743159118957217248367043905936319748237550094520674504208530837546834166925275516486044134775384991808184705966507606898412918594045916828375610659246423184062775112999150206172392431297837246097308511903252956622805412865917690043804311051417135098849101156584508839003337597742539960818209685142687562392007453579567729991395256699805775897135553415567045292136442139895777424891477161767258532611634530697452993846501061481697843891439474220308003706472837459911525285821188577408160690315522951458068463354171428220365223949985950890732881736611925133626529949897998045399734600887312408859224933727829625089164535236559716582775403784110923285873186648442456409760158728501220463308455437074192539205964902261490928669488824051563042951500651206733594863336608245755565801460390869016718045121902354170201577095168)",
+    "expression": {
+      "Number": {
+        "denominator": "522194440706576253345876355358312191289982124523691890192116741641976953985778728424413405967498779170445053357219631418993786719092896803631618043925682638972978488271854999170180795067191859157214035005927973113188159419698856372836167342172293308748403954352901852035642024370059304557233988891799014503343469488440893892973452815095130470299789726716411734651513348221529512507986199933857107770846917779942645743159118957217248367043905936319748237550094520674504208530837546834166925275516486044134775384991808184705966507606898412918594045916828375610659246423184062775112999150206172392431297837246097308511903252956622805412865917690043804311051417135098849101156584508839003337597742539960818209685142687562392007453579567729991395256699805775897135553415567045292136442139895777424891477161767258532611634530697452993846501061481697843891439474220308003706472837459911525285821188577408160690315522951458068463354171428220365223949985950890732881736611925133626529949897998045399734600887312408859224933727829625089164535236559716582775403784110923285873186648442456409760158728501220463308455437074192539205964902261490928669488824051563042951500651206733594863336608245755565801460390869016718045121902354170201577095168",
+        "numerator": "1"
+      }
+    },
+    "name": "one_over_two_to_4095"
+  },
+  {
+    "canonical_source": "ratio(-1044388881413152506691752710716624382579964249047383780384233483283953907971557456848826811934997558340890106714439262837987573438185793607263236087851365277945956976543709998340361590134383718314428070011855946226376318839397712745672334684344586617496807908705803704071284048740118609114467977783598029006686938976881787785946905630190260940599579453432823469303026696443059025015972399867714215541693835559885291486318237914434496734087811872639496475100189041349008417061675093668333850551032972088269550769983616369411933015213796825837188091833656751221318492846368125550225998300412344784862595674492194617023806505913245610825731835380087608622102834270197698202313169017678006675195485079921636419370285375124784014907159135459982790513399611551794271106831134090584272884279791554849782954323534517065223269061394905987693002122963395687782878948440616007412945674919823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335, 1)",
+    "expression": {
+      "Number": {
+        "denominator": "1",
+        "numerator": "-1044388881413152506691752710716624382579964249047383780384233483283953907971557456848826811934997558340890106714439262837987573438185793607263236087851365277945956976543709998340361590134383718314428070011855946226376318839397712745672334684344586617496807908705803704071284048740118609114467977783598029006686938976881787785946905630190260940599579453432823469303026696443059025015972399867714215541693835559885291486318237914434496734087811872639496475100189041349008417061675093668333850551032972088269550769983616369411933015213796825837188091833656751221318492846368125550225998300412344784862595674492194617023806505913245610825731835380087608622102834270197698202313169017678006675195485079921636419370285375124784014907159135459982790513399611551794271106831134090584272884279791554849782954323534517065223269061394905987693002122963395687782878948440616007412945674919823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335"
+      }
+    },
+    "name": "negative_4096_bit_bound"
+  }
+]

crates/oa-core/src/analysis_numeric/meter.rs

@@ -0,0 +1,240 @@
+use super::{NumericError, NumericLimit};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+/// Every event is charged once per dynamic occurrence, before entering it.
+///
+/// A Call expression therefore charges Expression and CalculationEntry; a
+/// Property read charges Expression and PropertyBinding. List element visits
+/// are additional to evaluation of their expressions. Only executed branches
+/// are charged. Targets are sorted by category (properties, then checks), then
+/// stable UUID bytes, by the integrating evaluator.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum EvaluationStep {
+    Target,
+    Expression,
+    CalculationEntry,
+    PropertyBinding,
+    ListElement,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum NumericOperation {
+    ParseWire,
+    ParseLiteral,
+    Add,
+    Subtract,
+    Multiply,
+    Divide,
+    Compare,
+    Negate,
+    Absolute,
+    Reciprocal,
+    Power,
+    KindAssertion,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum WorkResource {
+    DynamicEvents,
+    NumericUnits,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum WorkSite {
+    Evaluation(EvaluationStep),
+    Numeric(NumericOperation),
+}
+
+/// Failed reservations consume no partial charge. The first failure is latched.
+#[derive(Debug, Clone, PartialEq, Eq, Error, Serialize, Deserialize)]
+#[error("{resource:?}: used {used}, requested {requested}, limit {limit}, at {site:?}")]
+pub struct WorkExhaustion {
+    pub resource: WorkResource,
+    pub used: u64,
+    pub requested: u64,
+    pub limit: u64,
+    pub site: WorkSite,
+}
+
+/// Provisional calibration ceilings, not measured execution-time guarantees.
+///
+/// Effective limits, profile identity, capture, targets and context must all be
+/// recorded in request/result/frozen identity. A caller may lower these ceilings.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "WorkLimitsWire", into = "WorkLimitsWire")]
+pub struct WorkLimits {
+    dynamic_events: u64,
+    numeric_units: u64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct WorkLimitsWire {
+    dynamic_events: u64,
+    numeric_units: u64,
+}
+
+impl WorkLimits {
+    pub const REFERENCE: Self = Self {
+        dynamic_events: 1_000_000,
+        numeric_units: 50_000_000,
+    };
+
+    pub fn new(dynamic_events: u64, numeric_units: u64) -> Result<Self, NumericError> {
+        if dynamic_events > Self::REFERENCE.dynamic_events
+            || numeric_units > Self::REFERENCE.numeric_units
+        {
+            return Err(NumericError::InvalidWorkLimits);
+        }
+        Ok(Self {
+            dynamic_events,
+            numeric_units,
+        })
+    }
+
+    pub fn dynamic_events(self) -> u64 {
+        self.dynamic_events
+    }
+
+    pub fn numeric_units(self) -> u64 {
+        self.numeric_units
+    }
+}
+
+impl TryFrom<WorkLimitsWire> for WorkLimits {
+    type Error = NumericError;
+
+    fn try_from(value: WorkLimitsWire) -> Result<Self, Self::Error> {
+        Self::new(value.dynamic_events, value.numeric_units)
+    }
+}
+
+impl From<WorkLimits> for WorkLimitsWire {
+    fn from(value: WorkLimits) -> Self {
+        Self {
+            dynamic_events: value.dynamic_events,
+            numeric_units: value.numeric_units,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WorkUsage {
+    pub dynamic_events: u64,
+    pub numeric_units: u64,
+}
+
+/// Intentionally neither Clone nor Default: pass the same mutable meter through
+/// every target, numeric operation and expanded call in one evaluation request.
+///
+/// Exhaustion is terminal. Integrators must stop traversing siblings/targets and
+/// mark already collected causes as incomplete. Replaying an aggregate cache
+/// cost is insufficient if it changes the exact exhaustion location; initially
+/// retain logical traversal even when numerical values come from a cache.
+#[derive(Debug)]
+pub struct WorkMeter {
+    limits: WorkLimits,
+    usage: WorkUsage,
+    exhausted: Option<WorkExhaustion>,
+}
+
+impl WorkMeter {
+    pub fn new(limits: WorkLimits) -> Self {
+        Self {
+            limits,
+            usage: WorkUsage::default(),
+            exhausted: None,
+        }
+    }
+
+    pub fn limits(&self) -> WorkLimits {
+        self.limits
+    }
+
+    pub fn usage(&self) -> WorkUsage {
+        self.usage
+    }
+
+    pub fn exhaustion(&self) -> Option<&WorkExhaustion> {
+        self.exhausted.as_ref()
+    }
+
+    pub fn ensure_active(&self) -> Result<(), NumericError> {
+        match &self.exhausted {
+            Some(failure) => Err(NumericError::Limit(NumericLimit::Work(failure.clone()))),
+            None => Ok(()),
+        }
+    }
+
+    pub fn visit(&mut self, step: EvaluationStep) -> Result<(), NumericError> {
+        self.reserve(WorkResource::DynamicEvents, 1, WorkSite::Evaluation(step))
+    }
+
+    pub(super) fn numeric(
+        &mut self,
+        operation: NumericOperation,
+        units: u64,
+    ) -> Result<(), NumericError> {
+        self.reserve(
+            WorkResource::NumericUnits,
+            units,
+            WorkSite::Numeric(operation),
+        )
+    }
+
+    fn reserve(
+        &mut self,
+        resource: WorkResource,
+        requested: u64,
+        site: WorkSite,
+    ) -> Result<(), NumericError> {
+        self.ensure_active()?;
+        let (used, limit) = match resource {
+            WorkResource::DynamicEvents => (self.usage.dynamic_events, self.limits.dynamic_events),
+            WorkResource::NumericUnits => (self.usage.numeric_units, self.limits.numeric_units),
+        };
+        // Subtraction is safe: only successful reservations update usage.
+        if requested > limit - used {
+            let failure = WorkExhaustion {
+                resource,
+                used,
+                requested,
+                limit,
+                site,
+            };
+            self.exhausted = Some(failure.clone());
+            return Err(NumericError::Limit(NumericLimit::Work(failure)));
+        }
+        match resource {
+            WorkResource::DynamicEvents => self.usage.dynamic_events += requested,
+            WorkResource::NumericUnits => self.usage.numeric_units += requested,
+        }
+        Ok(())
+    }
+}
+
+// Logical 64-bit words are platform independent. These are deterministic
+// accounting weights, not a claim about num-bigint's internal algorithm/timing.
+pub(super) fn words(bits: u64) -> u64 {
+    bits.max(1).div_ceil(64)
+}
+
+pub(super) fn product_cost(a_bits: u64, b_bits: u64) -> u64 {
+    1 + words(a_bits) * words(b_bits)
+}
+
+pub(super) fn sum_cost(a_bits: u64, b_bits: u64) -> u64 {
+    1 + words(a_bits.max(b_bits))
+}
+
+pub(super) fn normalization_cost(n_bits: u64, d_bits: u64) -> u64 {
+    let width = words(n_bits.max(d_bits));
+    // 64*w² for GCD plus 2*w² for the two quotient operations.
+    1 + 66 * width * width
+}
+
+pub(super) fn parse_cost(digits: usize, estimated_bits: u64) -> u64 {
+    1 + digits as u64 * words(estimated_bits)
+}

crates/oa-core/src/analysis_numeric/quantity.rs

@@ -0,0 +1,385 @@
+use super::{Dimension, Exact, MAX_INTEGER_POWER, NumericError, NumericOperation, WorkMeter};
+use std::cmp::Ordering;
+
+/// K is supplied by the common resolver's verified nominal compatibility
+/// relation. It is not inferred from dimension/name/symbol/archive bytes here.
+/// Coordinate basis/algebra/difference-kind closure must be part of that proof.
+/// Exact definition references and pins remain the caller's provenance.
+/// K must be a bounded, cheap-to-clone/compare verified handle. Constructing or
+/// comparing an unbounded rooted contract graph is resolver admission work and
+/// must not be hidden inside K's Clone/Eq implementations. Rust trait bounds do
+/// not enforce this resource contract.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResolvedKind<K> {
+    key: K,
+    dimension: Dimension,
+    difference: Option<K>,
+}
+
+impl<K> ResolvedKind<K> {
+    pub fn linear(key: K, dimension: Dimension) -> Self {
+        Self {
+            key,
+            dimension,
+            difference: None,
+        }
+    }
+
+    pub fn key(&self) -> &K {
+        &self.key
+    }
+
+    pub fn dimension(&self) -> Dimension {
+        self.dimension
+    }
+
+    pub fn is_affine(&self) -> bool {
+        self.difference.is_some()
+    }
+}
+
+impl<K: Clone + Eq> ResolvedKind<K> {
+    pub fn affine(key: K, difference: &Self) -> Result<Self, NumericError> {
+        if difference.is_affine() || key == difference.key {
+            return Err(NumericError::DifferenceKind);
+        }
+        Ok(Self {
+            key,
+            dimension: difference.dimension,
+            difference: Some(difference.key.clone()),
+        })
+    }
+
+    pub fn difference_kind(&self) -> Option<Self> {
+        self.difference
+            .as_ref()
+            .map(|key| Self::linear(key.clone(), self.dimension))
+    }
+}
+
+/// Canonical coordinate = magnitude * scale + offset.
+/// Unit symbols and display preferences are outside this numeric representation.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Unit<K> {
+    kind: ResolvedKind<K>,
+    scale: Exact,
+    offset: Exact,
+}
+
+impl<K: Clone + Eq> Unit<K> {
+    pub fn new(kind: ResolvedKind<K>, scale: Exact, offset: Exact) -> Result<Self, NumericError> {
+        if !scale.is_positive() {
+            return Err(NumericError::UnitScale);
+        }
+        if !kind.is_affine() && !offset.is_zero() {
+            return Err(NumericError::LinearOffset);
+        }
+        Ok(Self {
+            kind,
+            scale,
+            offset,
+        })
+    }
+
+    pub fn kind(&self) -> &ResolvedKind<K> {
+        &self.kind
+    }
+
+    pub fn scale(&self) -> &Exact {
+        &self.scale
+    }
+
+    pub fn offset(&self) -> &Exact {
+        &self.offset
+    }
+
+    /// Fixed multiply-then-add path. Each reduced arithmetic stage is bounded.
+    /// A mathematically cancelling wider intermediate still reports NumericLimit;
+    /// replacing this path with a fused operation requires a new work profile.
+    pub fn to_canonical(
+        &self,
+        magnitude: &Exact,
+        meter: &mut WorkMeter,
+    ) -> Result<Exact, NumericError> {
+        magnitude
+            .multiply(&self.scale, meter)?
+            .add(&self.offset, meter)
+    }
+
+    /// Fixed subtract-then-divide path; never rounds a coordinate.
+    pub fn from_canonical(
+        &self,
+        coordinate: &Exact,
+        meter: &mut WorkMeter,
+    ) -> Result<Exact, NumericError> {
+        coordinate
+            .subtract(&self.offset, meter)?
+            .divide(&self.scale, meter)
+    }
+
+    pub fn convert(
+        &self,
+        magnitude: &Exact,
+        target: &Self,
+        meter: &mut WorkMeter,
+    ) -> Result<Exact, NumericError> {
+        meter.ensure_active()?;
+        if self.kind != target.kind {
+            return Err(NumericError::IncompatibleTypes);
+        }
+        target.from_canonical(&self.to_canonical(magnitude, meter)?, meter)
+    }
+}
+
+/// Internal numerical types. Boolean/list/check semantics belong to the common
+/// expression evaluator. Anonymous zero dimension normalizes to Number.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum NumericType<K> {
+    Number,
+    Named(ResolvedKind<K>),
+    Anonymous(Dimension),
+}
+
+impl<K> NumericType<K> {
+    pub fn dimension(&self) -> Dimension {
+        match self {
+            Self::Number => Dimension::ZERO,
+            Self::Named(kind) => kind.dimension,
+            Self::Anonymous(dimension) => *dimension,
+        }
+    }
+
+    pub fn is_affine(&self) -> bool {
+        matches!(self, Self::Named(kind) if kind.is_affine())
+    }
+
+    pub fn anonymous(dimension: Dimension) -> Self {
+        if dimension.is_dimensionless() {
+            Self::Number
+        } else {
+            Self::Anonymous(dimension)
+        }
+    }
+
+    pub fn normalized(self) -> Self {
+        match self {
+            Self::Anonymous(dimension) => Self::anonymous(dimension),
+            other => other,
+        }
+    }
+}
+
+impl<K: Clone + Eq> NumericType<K> {
+    /// Pure R6 algebra; does not evaluate coordinates or domain conditions.
+    pub fn additive_result(&self, rhs: &Self, subtract: bool) -> Result<Self, NumericError> {
+        use NumericType::{Anonymous, Named, Number};
+        let (left, right) = (self.clone().normalized(), rhs.clone().normalized());
+        match (&left, &right) {
+            (Number, Number) => Ok(Number),
+            (Anonymous(a), Anonymous(b)) if a == b => Ok(Anonymous(*a)),
+            (Named(a), Named(b)) => match (&a.difference, &b.difference) {
+                (None, None) if a == b => Ok(Named(a.clone())),
+                (Some(difference), Some(_)) if subtract && a == b => {
+                    Ok(Named(ResolvedKind::linear(difference.clone(), a.dimension)))
+                }
+                (Some(difference), None) if difference == &b.key && a.dimension == b.dimension => {
+                    Ok(Named(a.clone()))
+                }
+                (None, Some(difference))
+                    if !subtract && difference == &a.key && a.dimension == b.dimension =>
+                {
+                    Ok(Named(b.clone()))
+                }
+                _ => Err(NumericError::IncompatibleTypes),
+            },
+            _ => Err(NumericError::IncompatibleTypes),
+        }
+    }
+
+    pub fn multiplicative_result(&self, rhs: &Self, divide: bool) -> Result<Self, NumericError> {
+        use NumericType::Number;
+        let (left, right) = (self.clone().normalized(), rhs.clone().normalized());
+        if left.is_affine() || right.is_affine() {
+            return Err(NumericError::AffineOperation);
+        }
+        match (&left, &right) {
+            (Number, Number) => Ok(Number),
+            (_, Number) => Ok(left),
+            (Number, _) if !divide => Ok(right),
+            _ => Ok(Self::anonymous(if divide {
+                left.dimension().checked_quotient(right.dimension())?
+            } else {
+                left.dimension().checked_product(right.dimension())?
+            })),
+        }
+    }
+
+    pub fn unary_result(&self) -> Result<Self, NumericError> {
+        if self.is_affine() {
+            Err(NumericError::AffineOperation)
+        } else {
+            Ok(self.clone().normalized())
+        }
+    }
+
+    pub fn power_result(&self, exponent: i8) -> Result<Self, NumericError> {
+        if !(-MAX_INTEGER_POWER..=MAX_INTEGER_POWER).contains(&exponent) {
+            return Err(NumericError::IntegerPower);
+        }
+        if self.is_affine() {
+            return Err(NumericError::AffineOperation);
+        }
+        Ok(match exponent {
+            0 => Self::Number,
+            1 => self.clone().normalized(),
+            _ => Self::anonymous(self.dimension().checked_power(exponent)?),
+        })
+    }
+
+    pub fn comparison_compatible(&self, rhs: &Self) -> Result<(), NumericError> {
+        if self.clone().normalized() == rhs.clone().normalized() {
+            Ok(())
+        } else {
+            Err(NumericError::IncompatibleTypes)
+        }
+    }
+
+    pub fn assertion_result(&self, target: &ResolvedKind<K>) -> Result<Self, NumericError> {
+        if target.is_affine()
+            || matches!(self, Self::Named(_))
+            || self.dimension() != target.dimension
+        {
+            Err(NumericError::KindAssertion)
+        } else {
+            Ok(Self::Named(target.clone()))
+        }
+    }
+}
+
+/// A canonical rational coordinate with an internal numerical type.
+///
+/// Derived Eq compares stored representation. Formal equality/ordering must call
+/// compare(), which rejects mismatched nominal kinds instead of treating them
+/// as a false predicate. Public property output must still check its declared
+/// type and anchor the result to that declaration's exact definition reference.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NumericValue<K> {
+    value_type: NumericType<K>,
+    coordinate: Exact,
+}
+
+impl<K: Clone + Eq> NumericValue<K> {
+    pub fn new(value_type: NumericType<K>, coordinate: Exact) -> Self {
+        Self {
+            value_type: value_type.normalized(),
+            coordinate,
+        }
+    }
+
+    pub fn number(coordinate: Exact) -> Self {
+        Self::new(NumericType::Number, coordinate)
+    }
+
+    pub fn from_unit(
+        magnitude: &Exact,
+        unit: &Unit<K>,
+        meter: &mut WorkMeter,
+    ) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        Ok(Self::new(
+            NumericType::Named(unit.kind.clone()),
+            unit.to_canonical(magnitude, meter)?,
+        ))
+    }
+
+    pub fn value_type(&self) -> &NumericType<K> {
+        &self.value_type
+    }
+
+    pub fn coordinate(&self) -> &Exact {
+        &self.coordinate
+    }
+
+    pub fn display_in(&self, unit: &Unit<K>, meter: &mut WorkMeter) -> Result<Exact, NumericError> {
+        meter.ensure_active()?;
+        if !matches!(&self.value_type, NumericType::Named(kind) if kind == &unit.kind) {
+            return Err(NumericError::IncompatibleTypes);
+        }
+        unit.from_canonical(&self.coordinate, meter)
+    }
+
+    pub fn add(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.additive_result(&rhs.value_type, false)?;
+        Ok(Self::new(
+            output,
+            self.coordinate.add(&rhs.coordinate, meter)?,
+        ))
+    }
+
+    pub fn subtract(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.additive_result(&rhs.value_type, true)?;
+        Ok(Self::new(
+            output,
+            self.coordinate.subtract(&rhs.coordinate, meter)?,
+        ))
+    }
+
+    pub fn multiply(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self
+            .value_type
+            .multiplicative_result(&rhs.value_type, false)?;
+        Ok(Self::new(
+            output,
+            self.coordinate.multiply(&rhs.coordinate, meter)?,
+        ))
+    }
+
+    pub fn divide(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self
+            .value_type
+            .multiplicative_result(&rhs.value_type, true)?;
+        Ok(Self::new(
+            output,
+            self.coordinate.divide(&rhs.coordinate, meter)?,
+        ))
+    }
+
+    pub fn negated(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.unary_result()?;
+        Ok(Self::new(output, self.coordinate.negated(meter)?))
+    }
+
+    pub fn absolute(&self, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.unary_result()?;
+        Ok(Self::new(output, self.coordinate.absolute(meter)?))
+    }
+
+    pub fn power(&self, exponent: i8, meter: &mut WorkMeter) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.power_result(exponent)?;
+        Ok(Self::new(output, self.coordinate.power(exponent, meter)?))
+    }
+
+    pub fn compare(&self, rhs: &Self, meter: &mut WorkMeter) -> Result<Ordering, NumericError> {
+        meter.ensure_active()?;
+        self.value_type.comparison_compatible(&rhs.value_type)?;
+        self.coordinate.compare(&rhs.coordinate, meter)
+    }
+
+    pub fn as_kind(
+        &self,
+        target: &ResolvedKind<K>,
+        meter: &mut WorkMeter,
+    ) -> Result<Self, NumericError> {
+        meter.ensure_active()?;
+        let output = self.value_type.assertion_result(target)?;
+        meter.numeric(NumericOperation::KindAssertion, self.coordinate.copy_cost())?;
+        Ok(Self::new(output, self.coordinate.clone()))
+    }
+}

crates/oa-core/src/analysis_numeric/tests.rs

@@ -0,0 +1,804 @@
+use super::*;
+use num_bigint::BigInt;
+use num_traits::One;
+use std::cmp::Ordering;
+
+fn meter() -> WorkMeter {
+    WorkMeter::new(WorkLimits::REFERENCE)
+}
+
+fn exact(n: impl ToString, d: impl ToString) -> Exact {
+    Exact::from_wire(
+        &ExactWire {
+            numerator: n.to_string(),
+            denominator: d.to_string(),
+        },
+        &mut meter(),
+    )
+    .unwrap()
+}
+
+fn source(text: &str) -> Exact {
+    Exact::parse_literal(text, &mut meter()).unwrap()
+}
+
+fn assert_fraction(value: &Exact, n: impl ToString, d: impl ToString) {
+    assert_eq!(
+        value.to_wire(),
+        ExactWire {
+            numerator: n.to_string(),
+            denominator: d.to_string(),
+        }
+    );
+}
+
+// Independent bounded i128 oracle. It does not call the production Exact/GCD
+// implementation when deriving expected arithmetic or ordering.
+fn small_fraction(mut n: i128, mut d: i128) -> (i128, i128) {
+    assert_ne!(d, 0);
+    if d < 0 {
+        n = -n;
+        d = -d;
+    }
+    let (mut a, mut b) = (n.abs(), d);
+    while b != 0 {
+        (a, b) = (b, a % b);
+    }
+    (n / a, d / a)
+}
+
+#[test]
+fn arithmetic_matches_independent_small_integer_oracle() {
+    for a in [-5_i128, -2, 0, 1, 4] {
+        for b in [1_i128, 2, 3, 7] {
+            for c in [-5_i128, -2, 0, 1, 4] {
+                for d in [1_i128, 2, 3, 7] {
+                    let (an, ad) = small_fraction(a, b);
+                    let (bn, bd) = small_fraction(c, d);
+                    let left = exact(an, ad);
+                    let right = exact(bn, bd);
+                    let mut work = meter();
+                    let (n, den) = small_fraction(a * d + c * b, b * d);
+                    assert_fraction(&left.add(&right, &mut work).unwrap(), n, den);
+                    let (n, den) = small_fraction(a * d - c * b, b * d);
+                    assert_fraction(&left.subtract(&right, &mut work).unwrap(), n, den);
+                    let (n, den) = small_fraction(a * c, b * d);
+                    assert_fraction(&left.multiply(&right, &mut work).unwrap(), n, den);
+                    if c != 0 {
+                        let (n, den) = small_fraction(a * d, b * c);
+                        assert_fraction(&left.divide(&right, &mut work).unwrap(), n, den);
+                    } else {
+                        assert_eq!(
+                            left.divide(&right, &mut work),
+                            Err(NumericError::DivisionByZero)
+                        );
+                    }
+                    assert_eq!(
+                        left.compare(&right, &mut work).unwrap(),
+                        (a * d).cmp(&(c * b))
+                    );
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn decimals_are_exact_and_source_ratios_reduce() {
+    assert_fraction(
+        &source("0.1").add(&source("0.2"), &mut meter()).unwrap(),
+        3,
+        10,
+    );
+    assert_fraction(&source("0.50"), 1, 2);
+    assert_fraction(&source("12.50e-2"), 1, 8);
+    assert_fraction(&source("1e+3"), 1000, 1);
+    assert_fraction(&source("0001.2500"), 5, 4);
+    assert_fraction(&source(" ratio( -6, 8 ) "), -3, 4);
+    assert_fraction(&source("ratio(-0, 27)"), 0, 1);
+    assert_eq!(source("0.5").canonical_literal(), "ratio(1, 2)");
+    assert_eq!(source("42").canonical_literal(), "42");
+}
+
+#[test]
+fn powers_and_signs_have_explicit_domains() {
+    let x = exact(-2, 3);
+    assert_fraction(&x.power(3, &mut meter()).unwrap(), -8, 27);
+    assert_fraction(&x.power(-3, &mut meter()).unwrap(), -27, 8);
+    assert_fraction(&x.power(0, &mut meter()).unwrap(), 1, 1);
+    assert_fraction(&x.absolute(&mut meter()).unwrap(), 2, 3);
+    assert_fraction(&x.negated(&mut meter()).unwrap(), 2, 3);
+    assert_fraction(&x.reciprocal(&mut meter()).unwrap(), -3, 2);
+    let zero = Exact::from_integer(0);
+    assert_eq!(
+        zero.power(0, &mut meter()),
+        Err(NumericError::ZeroPowerZero)
+    );
+    assert_eq!(
+        zero.power(-1, &mut meter()),
+        Err(NumericError::DivisionByZero)
+    );
+    assert_eq!(x.power(17, &mut meter()), Err(NumericError::IntegerPower));
+    assert_eq!(
+        x.power(i8::MIN, &mut meter()),
+        Err(NumericError::IntegerPower)
+    );
+}
+
+#[test]
+fn canonical_wire_rejects_both_component_noncanonical_forms() {
+    for (n, d) in [
+        ("+1", "1"),
+        ("01", "1"),
+        ("-0", "1"),
+        ("1", "+1"),
+        ("1", "-1"),
+        ("1", "01"),
+        ("2", "4"),
+        ("0", "3"),
+        ("", "1"),
+        ("1", ""),
+        ("1.0", "1"),
+        ("1", "1.0"),
+        ("1e1", "1"),
+        ("1", "1e1"),
+        (" 1", "1"),
+        ("1", "1 "),
+    ] {
+        assert!(
+            Exact::from_wire(
+                &ExactWire {
+                    numerator: n.into(),
+                    denominator: d.into()
+                },
+                &mut meter(),
+            )
+            .is_err(),
+            "accepted {n}/{d}"
+        );
+    }
+    assert_eq!(
+        Exact::from_wire(
+            &ExactWire {
+                numerator: "1".into(),
+                denominator: "0".into()
+            },
+            &mut meter()
+        ),
+        Err(NumericError::ZeroDenominator)
+    );
+    assert_fraction(&exact(0, 1), 0, 1);
+    assert_fraction(&exact(-1, 2), -1, 2);
+}
+
+#[test]
+fn serde_uses_closed_canonical_string_wire() {
+    let value = exact(-3, 7);
+    let encoded = serde_json::to_value(&value).unwrap();
+    assert_eq!(
+        encoded,
+        serde_json::json!({"numerator":"-3","denominator":"7"})
+    );
+    assert_eq!(serde_json::from_value::<Exact>(encoded).unwrap(), value);
+    for invalid in [
+        r#"{"numerator":1,"denominator":"2"}"#,
+        r#"{"numerator":"1","denominator":2}"#,
+        r#"{"numerator":"1","denominator":"2","other":0}"#,
+        r#"{"numerator":"1","numerator":"2","denominator":"3"}"#,
+        r#"{"numerator":"1"}"#,
+        r#"{"numerator":"2","denominator":"4"}"#,
+    ] {
+        assert!(serde_json::from_str::<Exact>(invalid).is_err(), "{invalid}");
+    }
+}
+
+#[test]
+fn literal_reader_does_not_fold_expression_unary_minus() {
+    assert_eq!(
+        Exact::parse_literal("-2", &mut meter()),
+        Err(NumericError::InvalidLiteral)
+    );
+    let negative_literal = source("ratio(-2, 1)");
+    assert_eq!(negative_literal.canonical_literal(), "ratio(-2, 1)");
+    assert_eq!(source("2").negated(&mut meter()).unwrap(), negative_literal);
+    // Equality of coordinates does not claim AST equality. The expression
+    // parser must preserve UnaryNegate independently of its operand literal.
+    assert_eq!(source("2").canonical_literal(), "2");
+}
+
+#[test]
+fn literal_syntax_and_decimal_exponent_are_bounded() {
+    for invalid in [
+        "",
+        "-",
+        "+1",
+        ".5",
+        "1.",
+        "1.2.3",
+        "1e",
+        "1ee2",
+        "1e+-2",
+        "1_000",
+        "NaN",
+        "Infinity",
+        "1/2",
+        "ratio(1)",
+        "ratio(1,2,3)",
+        "ratio(1,-2)",
+        "ratio(+1,2)",
+        "ratio(1,2) + 1",
+        "１２",
+    ] {
+        assert!(
+            Exact::parse_literal(invalid, &mut meter()).is_err(),
+            "{invalid}"
+        );
+    }
+    for invalid in ["1e129", "1e-129", "1e9999999999999999999999"] {
+        assert_eq!(
+            Exact::parse_literal(invalid, &mut meter()),
+            Err(NumericError::DecimalExponent)
+        );
+    }
+    assert!(Exact::parse_literal("1e128", &mut meter()).is_ok());
+    assert!(Exact::parse_literal("1e-128", &mut meter()).is_ok());
+    assert_eq!(
+        Exact::parse_literal(&"1".repeat(MAX_COMPONENT_DIGITS + 1), &mut meter()),
+        Err(NumericError::LiteralTooLong)
+    );
+    assert_eq!(
+        Exact::parse_literal(&" ".repeat(MAX_LITERAL_BYTES + 1), &mut meter()),
+        Err(NumericError::LiteralTooLong)
+    );
+}
+
+#[test]
+fn full_independent_r7_packets_round_trip_as_literals_and_wire() {
+    let packets: serde_json::Value =
+        serde_json::from_str(include_str!("fixtures/r7-literal-boundaries.json")).unwrap();
+    for packet in packets.as_array().unwrap() {
+        let wire: ExactWire =
+            serde_json::from_value(packet["expression"]["Number"].clone()).unwrap();
+        let expected = Exact::from_wire(&wire, &mut meter()).unwrap();
+        let spelling = packet["canonical_source"].as_str().unwrap();
+        assert_eq!(expected.canonical_literal(), spelling);
+        assert_eq!(
+            Exact::parse_literal(spelling, &mut meter()).unwrap(),
+            expected
+        );
+        let serialized = serde_json::to_string(&expected).unwrap();
+        assert_eq!(
+            serde_json::from_str::<Exact>(&serialized).unwrap(),
+            expected
+        );
+        assert_eq!(expected.to_wire(), wire);
+    }
+}
+
+#[test]
+fn full_8193_bit_sum_intermediate_can_reduce_to_admitted_value() {
+    // N=(2^4096)-1, D=N-1. gcd(N,D)=1 and D is even.
+    // N/D + N/D = N/(D/2), although its un-reduced numerator needs 8193 bits.
+    let n = (BigInt::one() << 4096_usize) - 1_u8;
+    let d = &n - 1_u8;
+    let value = exact(&n, &d);
+    let result = value.add(&value, &mut meter()).unwrap();
+    assert_fraction(&result, &n, &d / 2_u8);
+}
+
+#[test]
+fn cross_products_cancel_before_reduced_component_limit() {
+    let n = BigInt::one() << 4095_usize;
+    let d = &n - 1_u8;
+    let left = exact(&n, &d);
+    let right = exact(&d, &n);
+    assert_fraction(&left.multiply(&right, &mut meter()).unwrap(), 1, 1);
+    assert_fraction(
+        &left
+            .add(&left.negated(&mut meter()).unwrap(), &mut meter())
+            .unwrap(),
+        0,
+        1,
+    );
+}
+
+#[test]
+fn both_reduced_component_overflows_are_reported() {
+    let n = BigInt::one() << 4095_usize;
+    let mut work = meter();
+    let failure = exact(&n, 1)
+        .multiply(&Exact::from_integer(2), &mut work)
+        .unwrap_err();
+    assert!(matches!(
+        failure,
+        NumericError::Limit(NumericLimit::Bits {
+            component: NumberComponent::Numerator,
+            bits: 4097,
+            ..
+        })
+    ));
+    assert!(work.exhaustion().is_none());
+    let failure = exact(1, &n)
+        .divide(&Exact::from_integer(2), &mut work)
+        .unwrap_err();
+    assert!(matches!(
+        failure,
+        NumericError::Limit(NumericLimit::Bits {
+            component: NumberComponent::Denominator,
+            bits: 4097,
+            ..
+        })
+    ));
+    // Value overflow is a nonterminal supported-operation failure; fuel
+    // exhaustion, in contrast, terminates the entire request.
+    assert_fraction(&source("1").add(&source("1"), &mut work).unwrap(), 2, 1);
+}
+
+#[test]
+fn wire_rejects_4097_bits_before_gcd_can_reduce_them() {
+    let oversized = (BigInt::one() << 4096_usize).to_string();
+    for wire in [
+        ExactWire {
+            numerator: oversized.clone(),
+            denominator: "1".into(),
+        },
+        ExactWire {
+            numerator: "1".into(),
+            denominator: oversized.clone(),
+        },
+        ExactWire {
+            numerator: oversized.clone(),
+            denominator: oversized,
+        },
+    ] {
+        assert!(matches!(
+            Exact::from_wire(&wire, &mut meter()),
+            Err(NumericError::Limit(NumericLimit::Bits { stage, .. })) if stage == "wire"
+        ));
+    }
+}
+
+#[test]
+fn numeric_precharge_precedes_big_integer_result_allocation() {
+    let n = BigInt::one() << 4095_usize;
+    let left = exact(&n, 1);
+    let mut work = WorkMeter::new(WorkLimits::new(10, 0).unwrap());
+    let failure = left
+        .multiply(&Exact::from_integer(2), &mut work)
+        .unwrap_err();
+    assert!(failure.is_terminal_work_exhaustion());
+    assert_eq!(work.usage().numeric_units, 0);
+    assert!(matches!(
+        work.exhaustion().unwrap().site,
+        WorkSite::Numeric(NumericOperation::Multiply)
+    ));
+    // With available fuel the same operation reaches the 4097-bit result check.
+    assert!(matches!(
+        left.multiply(&Exact::from_integer(2), &mut meter()),
+        Err(NumericError::Limit(NumericLimit::Bits { .. }))
+    ));
+    let too_wide_wire = ExactWire {
+        numerator: (BigInt::one() << 4096_usize).to_string(),
+        denominator: "1".into(),
+    };
+    let mut parse_work = WorkMeter::new(WorkLimits::new(0, 0).unwrap());
+    assert!(
+        Exact::from_wire(&too_wide_wire, &mut parse_work)
+            .unwrap_err()
+            .is_terminal_work_exhaustion()
+    );
+}
+
+#[test]
+fn provisional_limits_and_effective_limits_round_trip() {
+    let limits = WorkLimits::new(500, 2000).unwrap();
+    let encoded = serde_json::to_value(limits).unwrap();
+    assert_eq!(
+        encoded,
+        serde_json::json!({"dynamic_events":500,"numeric_units":2000})
+    );
+    assert_eq!(
+        serde_json::from_value::<WorkLimits>(encoded).unwrap(),
+        limits
+    );
+    assert_eq!(
+        WorkLimits::new(1_000_001, 0),
+        Err(NumericError::InvalidWorkLimits)
+    );
+    assert_eq!(
+        WorkLimits::new(0, 50_000_001),
+        Err(NumericError::InvalidWorkLimits)
+    );
+    assert!(
+        serde_json::from_str::<WorkLimits>(r#"{"dynamic_events":1000001,"numeric_units":0}"#)
+            .is_err()
+    );
+}
+
+#[test]
+fn exact_accounting_boundary_and_terminal_failure_are_stable() {
+    // One-word addition: three products at 2, one sum at 2,
+    // normalization at 67 => 75 logical numeric units.
+    let mut work = WorkMeter::new(WorkLimits::new(4, 75).unwrap());
+    assert_fraction(&exact(1, 2).add(&exact(1, 3), &mut work).unwrap(), 5, 6);
+    assert_eq!(work.usage().numeric_units, 75);
+    assert!(work.exhaustion().is_none());
+    let first = Exact::from_integer(1).negated(&mut work).unwrap_err();
+    let at_failure = work.usage();
+    assert_eq!(
+        work.exhaustion().unwrap(),
+        &WorkExhaustion {
+            resource: WorkResource::NumericUnits,
+            used: 75,
+            requested: 3,
+            limit: 75,
+            site: WorkSite::Numeric(NumericOperation::Negate),
+        }
+    );
+    assert_eq!(work.visit(EvaluationStep::Target).unwrap_err(), first);
+    assert_eq!(
+        Exact::from_integer(1)
+            .divide(&Exact::from_integer(0), &mut work)
+            .unwrap_err(),
+        first
+    );
+    assert_eq!(
+        work.numeric(NumericOperation::Compare, 0).unwrap_err(),
+        first
+    );
+    assert_eq!(work.usage(), at_failure);
+}
+
+#[test]
+fn zero_cost_and_maximum_reservation_do_not_underflow_or_reactivate() {
+    let mut work = WorkMeter::new(WorkLimits::new(0, 0).unwrap());
+    work.numeric(NumericOperation::Compare, 0).unwrap();
+    let failure = work
+        .numeric(NumericOperation::Multiply, u64::MAX)
+        .unwrap_err();
+    assert!(failure.is_terminal_work_exhaustion());
+    assert_eq!(work.usage(), WorkUsage::default());
+    assert_eq!(
+        work.numeric(NumericOperation::Compare, 0).unwrap_err(),
+        failure
+    );
+    let mut dynamic = WorkMeter::new(WorkLimits::new(0, 5).unwrap());
+    assert!(dynamic.visit(EvaluationStep::Target).is_err());
+    assert_eq!(dynamic.usage(), WorkUsage::default());
+}
+
+#[test]
+fn multiple_targets_share_one_aggregate_meter() {
+    let mut work = WorkMeter::new(WorkLimits::new(3, 50).unwrap());
+    work.visit(EvaluationStep::Target).unwrap();
+    work.visit(EvaluationStep::Expression).unwrap();
+    work.visit(EvaluationStep::Target).unwrap();
+    let failure = work.visit(EvaluationStep::Expression).unwrap_err();
+    assert!(failure.is_terminal_work_exhaustion());
+    assert_eq!(work.usage().dynamic_events, 3);
+}
+
+// A direct bounded call-tree workload, not an expression interpreter/dialect.
+fn expanded_calls(
+    depth: u8,
+    x: u64,
+    work: &mut WorkMeter,
+    entered: &mut u64,
+) -> Result<u64, NumericError> {
+    work.visit(EvaluationStep::CalculationEntry)?;
+    *entered += 1;
+    if depth == 0 {
+        return Ok(x);
+    }
+    let left = expanded_calls(depth - 1, 2 * x, work, entered)?;
+    let right = expanded_calls(depth - 1, 2 * x + 1, work, entered)?;
+    Ok(left + right)
+}
+
+#[test]
+fn c1_expanded_call_witness_terminates_at_dynamic_limit() {
+    let mut work = WorkMeter::new(WorkLimits::new(10_000, 0).unwrap());
+    let mut entered = 0;
+    let failure = expanded_calls(30, 0, &mut work, &mut entered).unwrap_err();
+    assert!(failure.is_terminal_work_exhaustion());
+    assert_eq!(entered, 10_000);
+    assert_eq!(work.usage().dynamic_events, 10_000);
+    assert_eq!(
+        work.exhaustion().unwrap().site,
+        WorkSite::Evaluation(EvaluationStep::CalculationEntry)
+    );
+    // Nearby finite control: 63 invocations, leaves 0..31, sum 496.
+    let mut bounded = WorkMeter::new(WorkLimits::new(63, 0).unwrap());
+    let mut entered = 0;
+    assert_eq!(
+        expanded_calls(5, 0, &mut bounded, &mut entered).unwrap(),
+        496
+    );
+    assert_eq!(entered, 63);
+    assert!(bounded.exhaustion().is_none());
+}
+
+fn dim(value: [i16; 7]) -> Dimension {
+    Dimension::new(value).unwrap()
+}
+
+fn linear(key: &str, dimension: Dimension) -> ResolvedKind<String> {
+    ResolvedKind::linear(key.to_owned(), dimension)
+}
+
+fn named(n: i64, kind: &ResolvedKind<String>) -> NumericValue<String> {
+    NumericValue::new(NumericType::Named(kind.clone()), Exact::from_integer(n))
+}
+
+#[test]
+fn dimensions_use_checked_seven_axis_integer_algebra() {
+    let length = dim([1, 0, 0, 0, 0, 0, 0]);
+    let mass = dim([0, 1, 0, 0, 0, 0, 0]);
+    let time = dim([0, 0, 1, 0, 0, 0, 0]);
+    assert_eq!(
+        mass.checked_product(length)
+            .unwrap()
+            .checked_quotient(time.checked_power(2).unwrap())
+            .unwrap(),
+        dim([1, 1, -2, 0, 0, 0, 0])
+    );
+    assert!(time.checked_quotient(time).unwrap().is_dimensionless());
+    assert!(matches!(
+        dim([32, 0, 0, 0, 0, 0, 0]).checked_product(length),
+        Err(NumericError::DimensionExponent {
+            axis: DimensionAxis::Length,
+            value: 33
+        })
+    ));
+    assert!(dim([0, 0, -32, 0, 0, 0, 0]).checked_quotient(time).is_err());
+    assert!(length.checked_power(i8::MIN).is_err());
+    assert!(Dimension::new([33, 0, 0, 0, 0, 0, 0]).is_err());
+    assert_eq!(
+        serde_json::to_value(time).unwrap(),
+        serde_json::json!([0, 0, 1, 0, 0, 0, 0])
+    );
+    for invalid in ["[0,0,33,0,0,0,0]", "[0,0,1]", "[0,0,1,0,0,0,0,0]"] {
+        assert!(serde_json::from_str::<Dimension>(invalid).is_err());
+    }
+}
+
+#[test]
+fn duration_unit_coordinates_are_exact_and_nominal() {
+    let duration = linear("duration", dim([0, 0, 1, 0, 0, 0, 0]));
+    let s = Unit::new(duration.clone(), source("1"), source("0")).unwrap();
+    let ms = Unit::new(duration.clone(), source("0.001"), source("0")).unwrap();
+    assert_fraction(&ms.convert(&source("750"), &s, &mut meter()).unwrap(), 3, 4);
+    let receive = NumericValue::from_unit(&source("750"), &ms, &mut meter()).unwrap();
+    let dispatch = NumericValue::from_unit(&source("1"), &s, &mut meter()).unwrap();
+    let total = receive.add(&dispatch, &mut meter()).unwrap();
+    assert_fraction(total.coordinate(), 7, 4);
+    assert_fraction(&total.display_in(&ms, &mut meter()).unwrap(), 1750, 1);
+    let different = Unit::new(
+        linear("different-kind", duration.dimension()),
+        source("1"),
+        source("0"),
+    )
+    .unwrap();
+    assert_eq!(
+        ms.convert(&source("750"), &different, &mut meter()),
+        Err(NumericError::IncompatibleTypes)
+    );
+    let inconsistent = Unit::new(
+        linear("duration", dim([1, 0, 0, 0, 0, 0, 0])),
+        source("1"),
+        source("0"),
+    )
+    .unwrap();
+    assert!(
+        ms.convert(&source("1"), &inconsistent, &mut meter())
+            .is_err()
+    );
+    assert!(Unit::new(duration.clone(), source("0"), source("0")).is_err());
+    assert!(Unit::new(duration.clone(), source("ratio(-1,1)"), source("0")).is_err());
+    assert_eq!(
+        Unit::new(duration, source("1"), source("1")).unwrap_err(),
+        NumericError::LinearOffset
+    );
+}
+
+#[test]
+fn affine_point_and_difference_arithmetic_has_distinct_kinds() {
+    let interval = linear("temperature-difference", dim([0, 0, 0, 0, 1, 0, 0]));
+    let point = ResolvedKind::affine("temperature-point".to_owned(), &interval).unwrap();
+    let celsius = Unit::new(point.clone(), source("1"), source("273.15")).unwrap();
+    let fahrenheit = Unit::new(
+        point.clone(),
+        source("ratio(5,9)"),
+        source("ratio(45967,180)"),
+    )
+    .unwrap();
+    let kelvin_interval = Unit::new(interval.clone(), source("1"), source("0")).unwrap();
+    assert_fraction(
+        &celsius
+            .convert(&source("0"), &fahrenheit, &mut meter())
+            .unwrap(),
+        32,
+        1,
+    );
+    assert_fraction(
+        &fahrenheit
+            .convert(&source("70"), &celsius, &mut meter())
+            .unwrap(),
+        190,
+        9,
+    );
+    let p20 = NumericValue::from_unit(&source("20"), &celsius, &mut meter()).unwrap();
+    let p10 = NumericValue::from_unit(&source("10"), &celsius, &mut meter()).unwrap();
+    let difference = p20.subtract(&p10, &mut meter()).unwrap();
+    assert_eq!(
+        difference.value_type(),
+        &NumericType::Named(interval.clone())
+    );
+    assert_fraction(
+        &difference
+            .display_in(&kelvin_interval, &mut meter())
+            .unwrap(),
+        10,
+        1,
+    );
+    let delta5 = named(5, &interval);
+    let p25 = p20.add(&delta5, &mut meter()).unwrap();
+    assert_fraction(&p25.display_in(&celsius, &mut meter()).unwrap(), 25, 1);
+    assert_eq!(delta5.add(&p20, &mut meter()).unwrap(), p25);
+    assert!(p20.add(&p10, &mut meter()).is_err());
+    assert!(delta5.subtract(&p20, &mut meter()).is_err());
+    assert_eq!(
+        p20.power(1, &mut meter()),
+        Err(NumericError::AffineOperation)
+    );
+    assert_eq!(
+        p20.negated(&mut meter()),
+        Err(NumericError::AffineOperation)
+    );
+    assert_eq!(p20.compare(&p10, &mut meter()).unwrap(), Ordering::Greater);
+    assert!(p20.display_in(&kelvin_interval, &mut meter()).is_err());
+    assert!(ResolvedKind::affine(interval.key().clone(), &interval).is_err());
+    assert!(ResolvedKind::affine("other".to_owned(), &point).is_err());
+}
+
+#[test]
+fn affine_conversion_rejects_a_wider_stage_even_when_the_final_value_would_fit() {
+    // A fused coordinate calculation 2*m-m equals m, where m=2^4095 fits.
+    // The fixed multiply stage produces 2^4096, so it must fail before offset
+    // cancellation. The inverse path likewise rejects (m-(-m))/2 at subtraction.
+    let large = BigInt::one() << 4095_usize;
+    let magnitude = exact(&large, 1);
+    let interval = linear("temperature-interval", dim([0, 0, 0, 0, 1, 0, 0]));
+    let point = ResolvedKind::affine("temperature-point".to_owned(), &interval).unwrap();
+    let unit = Unit::new(point, Exact::from_integer(2), exact(-&large, 1)).unwrap();
+    let mut work = meter();
+    for outcome in [
+        unit.to_canonical(&magnitude, &mut work),
+        unit.from_canonical(&magnitude, &mut work),
+    ] {
+        assert!(matches!(
+            outcome,
+            Err(NumericError::Limit(NumericLimit::Bits {
+                component: NumberComponent::Numerator,
+                bits: 4097,
+                limit: MAX_COMPONENT_BITS,
+                ..
+            }))
+        ));
+    }
+    assert!(work.exhaustion().is_none());
+    let half = exact(&large >> 1_usize, 1);
+    assert_fraction(&unit.to_canonical(&half, &mut work).unwrap(), 0, 1);
+    assert_eq!(
+        unit.from_canonical(&Exact::from_integer(0), &mut work)
+            .unwrap(),
+        half
+    );
+}
+
+#[test]
+fn r6_anonymous_compound_energy_needs_one_outer_assertion() {
+    let force = linear("force", dim([1, 1, -2, 0, 0, 0, 0]));
+    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
+    let energy = linear("energy", dim([2, 1, -2, 0, 0, 0, 0]));
+    let a = named(3, &force)
+        .multiply(&named(4, &length), &mut meter())
+        .unwrap();
+    let b = named(2, &force)
+        .multiply(&named(7, &length), &mut meter())
+        .unwrap();
+    assert_eq!(a.value_type(), &NumericType::Anonymous(energy.dimension()));
+    let sum = a.add(&b, &mut meter()).unwrap();
+    let result = sum.as_kind(&energy, &mut meter()).unwrap();
+    assert_fraction(result.coordinate(), 26, 1);
+    assert_eq!(result.value_type(), &NumericType::Named(energy.clone()));
+    assert_eq!(a.compare(&b, &mut meter()).unwrap(), Ordering::Less);
+    assert!(result.add(&sum, &mut meter()).is_err());
+    assert_eq!(
+        result.as_kind(&energy, &mut meter()),
+        Err(NumericError::KindAssertion)
+    );
+}
+
+#[test]
+fn anonymous_product_then_quotient_closes_and_preserves_scaling() {
+    let mass = linear("mass", dim([0, 1, 0, 0, 0, 0, 0]));
+    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
+    let time = linear("duration", dim([0, 0, 1, 0, 0, 0, 0]));
+    let momentum = linear("momentum", dim([1, 1, -1, 0, 0, 0, 0]));
+    let result = named(2, &mass)
+        .multiply(&named(3, &length), &mut meter())
+        .unwrap()
+        .divide(&named(2, &time), &mut meter())
+        .unwrap()
+        .as_kind(&momentum, &mut meter())
+        .unwrap();
+    assert_fraction(result.coordinate(), 3, 1);
+    let scalar = NumericValue::number(source("2"));
+    let scaled = scalar.multiply(&named(3, &time), &mut meter()).unwrap();
+    assert_eq!(scaled.value_type(), &NumericType::Named(time.clone()));
+    assert_fraction(scaled.coordinate(), 6, 1);
+    assert_eq!(
+        named(3, &time)
+            .divide(&scalar, &mut meter())
+            .unwrap()
+            .value_type(),
+        &NumericType::Named(time.clone())
+    );
+    assert_eq!(
+        scalar
+            .divide(&named(3, &time), &mut meter())
+            .unwrap()
+            .value_type(),
+        &NumericType::Anonymous(dim([0, 0, -1, 0, 0, 0, 0]))
+    );
+}
+
+#[test]
+fn nominal_kinds_survive_comparison_but_explicit_quotients_can_erase_dimension() {
+    let energy = linear("energy", dim([2, 1, -2, 0, 0, 0, 0]));
+    let torque = linear("torque", energy.dimension());
+    let left = named(7, &energy);
+    let right = named(7, &torque);
+    assert!(left.add(&right, &mut meter()).is_err());
+    assert!(left.compare(&right, &mut meter()).is_err());
+    let ratio = left.divide(&right, &mut meter()).unwrap();
+    assert_eq!(ratio.value_type(), &NumericType::Number);
+    assert_fraction(ratio.coordinate(), 1, 1);
+    let named_ratio = linear("chosen-ratio", Dimension::ZERO);
+    let asserted = ratio.as_kind(&named_ratio, &mut meter()).unwrap();
+    assert_eq!(
+        asserted.value_type(),
+        &NumericType::Named(named_ratio.clone())
+    );
+    assert!(asserted.add(&ratio, &mut meter()).is_err());
+    assert_eq!(
+        NumericValue::<String>::new(NumericType::Anonymous(Dimension::ZERO), source("1")),
+        NumericValue::number(source("1"))
+    );
+}
+
+#[test]
+fn numerical_power_types_and_dimension_overflow_are_checked() {
+    let length = linear("length", dim([1, 0, 0, 0, 0, 0, 0]));
+    let value = named(2, &length);
+    assert_eq!(
+        value.power(0, &mut meter()).unwrap().value_type(),
+        &NumericType::Number
+    );
+    assert_eq!(
+        value.power(1, &mut meter()).unwrap().value_type(),
+        value.value_type()
+    );
+    assert_eq!(
+        value.power(-2, &mut meter()).unwrap().value_type(),
+        &NumericType::Anonymous(dim([-2, 0, 0, 0, 0, 0, 0]))
+    );
+    let large_dimension = linear("large-dimension", dim([32, 0, 0, 0, 0, 0, 0]));
+    assert!(
+        named(1, &large_dimension)
+            .multiply(&value, &mut meter())
+            .is_err()
+    );
+    assert!(named(1, &large_dimension).power(2, &mut meter()).is_err());
+}

crates/oa-core/src/language.rs

@@ -1,10 +1,14 @@
 //! Typed OA/SA language, tolerant source analysis, and explicit V1/V2/V3/V4 migration.
 #[path = "language/semantic_source.rs"]
 mod semantic_source;
+mod source3_bridge;
+mod raw_tokens;
+// Staged syntax foundation only. Public source8 admission waits for complete
+// declaration lowering, source updates and the root-owned resource gate.
+#[cfg(test)]
+mod analysis_source;
 #[path = "migration_v2/source.rs"]
 mod v2_source;
-pub(crate) use crate::source_defaults::Mode as DeclarationFormat;
-use crate::source_defaults::{self, Context as DefaultContext};
 use crate::*;
 use serde_json::{Map, Value};
 use std::{collections::BTreeMap, fmt};
@@ -62,7 +66,8 @@ impl ParseLimits {
         let graph = project
             .elements
             .len()
-            .saturating_add(project.relations.len());
+            .saturating_add(project.relations.len())
+            .saturating_add(project.definitions.len());
         let records = graph
             .saturating_add(1)
             .saturating_add(project.diagrams.len())
@@ -81,7 +86,8 @@ impl ParseLimits {
                     .sum::<usize>(),
             )
             .saturating_add(project.artifact_links.len())
-            .saturating_add(project.traces.len());
+            .saturating_add(project.traces.len())
+            .saturating_add(crate::analysis::nested_record_count(project));
         let steps = project
             .elements
             .values()
@@ -144,164 +150,10 @@ pub struct Analysis {
     pub declarations: Vec<DeclarationSpan>,
 }
 
-/// Check the decoded spelling required by declaration-header UUID clauses.
-/// This is the shared 36-byte/hyphen shape rule, not a hexadecimal parser:
-/// callers must additionally parse the UUID. Uppercase hex and JSON escapes
-/// that decode to this spelling remain accepted. URN/braced/compact forms do not.
-pub fn has_uuid_header_shape(decoded: &str) -> bool {
-    decoded.len() == 36
-        && [8, 13, 18, 23]
-            .into_iter()
-            .all(|index| decoded.as_bytes()[index] == b'-')
-}
-
-/// Budgets for one original source buffer. Policy is caller-owned; these
-/// limits do not change the grammar or perform model admission.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct OutlineLimits {
-    pub max_source_bytes: usize,
-    pub max_tokens: usize,
-    pub max_declarations: usize,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum OutlineResource {
-    SourceBytes,
-    Tokens,
-    Declarations,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct OutlineLimit {
-    pub resource: OutlineResource,
-    pub limit: usize,
-    pub observed_at_least: usize,
-    /// Original byte offset where admission stopped; never a rewritten offset.
-    pub offset: usize,
-}
-
-/// Roles discovered by the existing tolerant declaration walk. Keeping the
-/// wrapper preserves DeclarationSpan and Analysis as existing public APIs.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct OutlineDeclaration {
-    pub declaration: DeclarationSpan,
-    pub kind_span: Span,
-    pub alias_span: Span,
-    /// Whole quoted header ID token, even if it is not a valid UUID. In that
-    /// case declaration.id is None. Missing/non-string ID values have no span.
-    pub id_literal_span: Option<Span>,
-}
-
-/// A full-file tolerant scan, not a successful parse or validated model. Invalid
-/// text remains available. Lexical errors and unmatched braces are facts only:
-/// their absence does not establish syntactic or semantic validity.
-///
-/// A budget failure returns Err and no partial Outline. Include reachability,
-/// project completeness and editor revision are intentionally not inferred here.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Outline<'a> {
-    pub source: &'a str,
-    pub tokens: Vec<TokenSpan>,
-    pub declarations: Vec<OutlineDeclaration>,
-    pub has_lexical_errors: bool,
-    pub has_unmatched_braces: bool,
-}
-
 /// Tolerant highlighting tokens cover the whole input, including incomplete
 /// strings and unexpected characters. No model is created or modified.
 pub fn tokenize(source: &str) -> Vec<TokenSpan> {
-    tokenize_with_limit(source, usize::MAX).expect("unlimited token scan")
-}
-
-fn tokenize_with_limit(source: &str, max_tokens: usize) -> Result<Vec<TokenSpan>, OutlineLimit> {
-    let mut tokens = Vec::new();
-    let mut cursor = 0;
-    while cursor < source.len() {
-        if tokens.len() == max_tokens {
-            return Err(OutlineLimit {
-                resource: OutlineResource::Tokens,
-                limit: max_tokens,
-                observed_at_least: tokens.len().saturating_add(1),
-                offset: cursor,
-            });
-        }
-        let start = cursor;
-        let ch = source[cursor..].chars().next().expect("in bounds");
-        let class = if matches!(ch, ' ' | '\t' | '\r' | '\n') {
-            cursor += 1;
-            while source
-                .as_bytes()
-                .get(cursor)
-                .is_some_and(|next| matches!(*next, b' ' | b'\t' | b'\r' | b'\n'))
-            {
-                cursor += 1;
-            }
-            TokenClass::Whitespace
-        } else if source[cursor..].starts_with("//") {
-            cursor += source[cursor..].find('\n').unwrap_or(source.len() - cursor);
-            TokenClass::Comment
-        } else if ch == '"' {
-            cursor += 1;
-            let mut escaped = false;
-            let mut closed = false;
-            while cursor < source.len() {
-                let next = source[cursor..].chars().next().expect("in bounds");
-                cursor += next.len_utf8();
-                if escaped {
-                    escaped = false;
-                } else if next == '\\' {
-                    escaped = true;
-                } else if next == '"' {
-                    closed = true;
-                    break;
-                }
-            }
-            if closed && serde_json::from_str::<String>(&source[start..cursor]).is_ok() {
-                TokenClass::String
-            } else {
-                TokenClass::Error
-            }
-        } else if ch.is_ascii_alphabetic() || ch == '_' {
-            cursor += 1;
-            while source
-                .as_bytes()
-                .get(cursor)
-                .is_some_and(|next| next.is_ascii_alphanumeric() || *next == b'_')
-            {
-                cursor += 1;
-            }
-            if reserved(&source[start..cursor])
-                || matches!(&source[start..cursor], "true" | "false" | "none")
-            {
-                TokenClass::Keyword
-            } else {
-                TokenClass::Identifier
-            }
-        } else if ch.is_ascii_digit() || matches!(ch, '-' | '+' | '.') {
-            cursor += 1;
-            while source.as_bytes().get(cursor).is_some_and(|next| {
-                next.is_ascii_alphanumeric() || matches!(*next, b'.' | b'+' | b'-' | b'_')
-            }) {
-                cursor += 1;
-            }
-            if serde_json::from_str::<serde_json::Number>(&source[start..cursor]).is_ok() {
-                TokenClass::Number
-            } else {
-                TokenClass::Error
-            }
-        } else if "{}();,[]:=@".contains(ch) {
-            cursor += ch.len_utf8();
-            TokenClass::Punctuation
-        } else {
-            cursor += ch.len_utf8();
-            TokenClass::Error
-        };
-        tokens.push(TokenSpan {
-            class,
-            span: Span { start, end: cursor },
-        });
-    }
-    Ok(tokens)
+    raw_tokens::legacy(source)
 }
 
 pub fn lint(source: &str) -> Vec<Diagnostic> {
@@ -647,34 +499,25 @@ fn offset_for(source: &str, line: usize, column: usize) -> usize {
     source.len()
 }
 
-/// Canonical output uses persistent aliases and explicit identities, omitting
-/// only values supplied by source defaults. Typed nested records are ordinary
-/// language fields; JSON documents are not embedded.
+/// Canonical output uses persistent aliases and explicit identities. Typed
+/// nested records are ordinary language fields; JSON documents are not embedded.
 pub fn format(project: &Project) -> String {
     let mut out = std::format!(
-        "arcadia {SCHEMA_VERSION};\nproject {} {} id \"{}\" {{\n",
+        "arcadia {SCHEMA_VERSION};\nproject {} {} id \"{}\" {{\n    description {};\n\n",
         project.alias,
         quote(&project.name),
         project.id,
+        quote(&project.description)
     );
-    if !project.description.is_empty() {
-        out.push_str(&std::format!(
-            "    description {};\n",
-            quote(&project.description)
-        ));
-    }
-    out.push('\n');
-    for (_, declaration) in format_declarations(project, DeclarationFormat::Compact) {
+    for (_, declaration) in format_declarations(project) {
         out.push_str(&declaration);
     }
     out.push_str("}\n");
     out
 }
 
-/// Shared typed writer for canonical output and lossless editing. Complete edit
-/// comparisons retain defaults; emitted declarations and value fragments apply
-/// only the omission rules valid in their selected source context.
-pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) -> Vec<(Id, String)> {
+/// The same typed declaration writer is used by flat and modular source output.
+pub(crate) fn format_declarations(project: &Project) -> Vec<(Id, String)> {
     let aliases = project
         .identities()
         .into_iter()
@@ -686,7 +529,6 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
         let mut fields = payload(&serde_json::to_value(&e.body).unwrap());
         fields.insert("description".into(), Value::String(e.description.clone()));
         fields.insert("parent".into(), serde_json::to_value(e.parent).unwrap());
-        let fields = source_defaults::fields(DefaultContext::Element(e.kind()), &fields, mode);
         write_declaration(
             &mut out,
             &element_word(e.kind(), e.layer()),
@@ -702,7 +544,6 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
         let mut out = String::new();
         let mut fields = payload(&serde_json::to_value(&r.body).unwrap());
         fields.insert("description".into(), Value::String(r.description.clone()));
-        let fields = source_defaults::fields(DefaultContext::Relation(r.kind()), &fields, mode);
         write_declaration(
             &mut out,
             &relation_word(r.kind()),
@@ -718,7 +559,6 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
         let mut out = String::new();
         let mut fields = record_fields(d);
         fields.remove("nodes");
-        let fields = source_defaults::fields(DefaultContext::Diagram, &fields, mode);
         write_declaration(
             &mut out,
             "diagram",
@@ -733,7 +573,6 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
             let mut out = String::new();
             let mut fields = record_fields(n);
             fields.insert("diagram".into(), Value::String(d.id.to_string()));
-            let fields = source_defaults::fields(DefaultContext::Node, &fields, mode);
             write_declaration(&mut out, "node", &n.alias, None, n.id, &fields, &aliases);
             declarations.push((n.id, out));
         }
@@ -746,7 +585,7 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
             &a.alias,
             Some(&a.name),
             a.id,
-            &source_defaults::fields(DefaultContext::Artifact, &record_fields(a), mode),
+            &record_fields(a),
             &aliases,
         );
         declarations.push((a.id, out));
@@ -759,7 +598,7 @@ pub(crate) fn format_declarations(project: &Project, mode: DeclarationFormat) ->
             &t.alias,
             Some(&t.name),
             t.id,
-            &source_defaults::fields(DefaultContext::Trace, &record_fields(t), mode),
+            &record_fields(t),
             &aliases,
         );
         declarations.push((t.id, out));
@@ -1320,7 +1159,11 @@ impl Parser<'_> {
         self.cursor += 1;
         let offset = self.current().span.start;
         let value = self.quoted()?;
-        if !has_uuid_header_shape(&value) {
+        if value.len() != 36
+            || ![8, 13, 18, 23]
+                .into_iter()
+                .all(|i| value.as_bytes()[i] == b'-')
+        {
             return Err(Error {
                 code: "invalid_source",
                 offset,
@@ -1512,6 +1355,7 @@ impl Parser<'_> {
                     alias,
                     name,
                     description: String::new(),
+                    definitions: BTreeMap::new(),
                     elements: BTreeMap::new(),
                     relations: BTreeMap::new(),
                     diagrams: BTreeMap::new(),
@@ -1732,6 +1576,9 @@ pub(crate) fn resolve_declarations(
                         }
                         parent = Some(owner);
                     }
+                    if kind.is_analysis() {
+                        return Err(conversion_error("Analysis records require the source8 authoring implementation.".into()));
+                    }
                     let mut initial = if kind == Kind::Port {
                         if !fields.contains_key("contract") {
                             return Err(conversion_error(
@@ -1757,9 +1604,7 @@ pub(crate) fn resolve_declarations(
                         *viewpoint = ScenarioViewpoint::MixedLegacy;
                     }
                     let mut body = serde_json::to_value(initial).unwrap();
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Element(kind))
-                    } else if legacy {
+                    let defaults = if legacy {
                         crate::persistence::v3::legacy_defaults(kind)
                             .and_then(|value| value.as_object().cloned())
                             .unwrap_or_else(|| payload(&body))
@@ -1816,12 +1661,7 @@ pub(crate) fn resolve_declarations(
                     let mut body =
                         serde_json::to_value(RelationBody::new(kind, Id::nil(), Id::nil()))
                             .unwrap();
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Relation(kind))
-                    } else {
-                        payload(&body)
-                    };
-                    let merged = merge_fields(defaults, fields).map_err(&conversion_error)?;
+                    let merged = merge_fields(payload(&body), fields).map_err(&conversion_error)?;
                     replace_payload(&mut body, merged);
                     let body = serde_json::from_value(body)
                         .map_err(|e| conversion_error(e.to_string()))?;
@@ -1846,10 +1686,7 @@ pub(crate) fn resolve_declarations(
                     }
                     let defaults =
                         serde_json::json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":crate::view_options::ViewOptions::default()});
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Diagram)
-                    } else { defaults.as_object().unwrap().clone() };
-                    let mut record = merge_fields(defaults, fields)
+                    let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, true);
                     record.insert("nodes".into(), serde_json::json!({}));
@@ -1864,10 +1701,7 @@ pub(crate) fn resolve_declarations(
                         return Err(conversion_error("Missing required field 'element'.".into()));
                     }
                     let defaults = serde_json::json!({"element":null,"position":{"x":0.0,"y":0.0},"size":{"width":224.0,"height":94.0},"collapsed":false,"port_anchors":[]});
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Node)
-                    } else { defaults.as_object().unwrap().clone() };
-                    let mut record = merge_fields(defaults, fields)
+                    let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, false);
                     let node: NodePlacement = serde_json::from_value(Value::Object(record))
@@ -1879,10 +1713,7 @@ pub(crate) fn resolve_declarations(
                         return Err(conversion_error("Missing required field 'owner'.".into()));
                     }
                     let defaults = serde_json::json!({"description":"","owner":null,"relation":"References","uri":"","revision":null,"fragment":null});
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Artifact)
-                    } else { defaults.as_object().unwrap().clone() };
-                    let mut record = merge_fields(defaults, fields)
+                    let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, true);
                     let artifact = serde_json::from_value(Value::Object(record))
@@ -1898,10 +1729,7 @@ pub(crate) fn resolve_declarations(
                         }
                     }
                     let defaults = serde_json::json!({"description":"","oa":null,"sa":null,"kind":"Refinement","baseline":null});
-                    let defaults = if project.schema_version >= 7 {
-                        source_defaults::parser_fields(DefaultContext::Trace)
-                    } else { defaults.as_object().unwrap().clone() };
-                    let mut record = merge_fields(defaults, fields)
+                    let mut record = merge_fields(defaults.as_object().unwrap().clone(), fields)
                         .map_err(&conversion_error)?;
                     header(&mut record, d, true);
                     let trace = if project.schema_version < 5 {
@@ -1929,10 +1757,7 @@ pub(crate) fn resolve_declarations(
         target.nodes.insert(node.id, node);
     }
     if legacy {
-        let mut value = serde_json::to_value(&project).expect("project serialization");
-        value["elements"] = Value::Object(legacy_elements);
-        let migrated = serde_json::from_value(value)
-            .map_err(crate::persistence::FileError::Json)
+        let migrated = source3_bridge::from_scratch(project, legacy_elements)
             .and_then(|old| crate::persistence::v3::migrate(old, limits))
             .map_err(|error| {
                 let issue = if let crate::persistence::FileError::Model { issues, .. } = &error {
@@ -1980,13 +1805,15 @@ pub(crate) fn resolve_declarations(
         }
         return Ok(migrated);
     }
-    if matches!(project.schema_version, 4..=6) {
+    if matches!(project.schema_version, 4..=7) {
         return (if project.schema_version == 4 {
             crate::persistence::v4::finish(project, limits)
         } else if project.schema_version == 5 {
             crate::persistence::migrate_v5(project, limits)
-        } else {
+        } else if project.schema_version == 6 {
             crate::persistence::migrate_v6(project, limits)
+        } else {
+            crate::persistence::migrate_v7(project, limits)
         })
         .map_err(|error| {
             (
@@ -2067,49 +1894,8 @@ fn take_required_id(fields: &mut Map<String, Value>, key: &str) -> Result<Id, St
 
 /// Analyze an incomplete source buffer without adopting a candidate. Declaration
 /// spans remain available even when a later declaration contains errors.
-/// Invalid compact/braced/URN header IDs retain no authored identity, matching
-/// the declaration parser rather than the UUID crate's broader accepted forms.
 pub fn analyze(source: &str) -> Analysis {
     let tokens = tokenize(source);
-    let (declarations, _) =
-        declaration_outline(source, &tokens, usize::MAX).expect("unlimited declaration walk");
-    Analysis {
-        tokens,
-        diagnostics: lint(source),
-        declarations: declarations.into_iter().map(|d| d.declaration).collect(),
-    }
-}
-
-/// Read exact current text without lint, parsing a model, stabilization or I/O.
-/// Source bytes are admitted before token allocation; token/declaration limits
-/// are checked before lexing the next token or materializing the next record.
-pub fn outline(source: &str, limits: OutlineLimits) -> Result<Outline<'_>, OutlineLimit> {
-    if source.len() > limits.max_source_bytes {
-        return Err(OutlineLimit {
-            resource: OutlineResource::SourceBytes,
-            limit: limits.max_source_bytes,
-            observed_at_least: source.len(),
-            offset: 0,
-        });
-    }
-    let tokens = tokenize_with_limit(source, limits.max_tokens)?;
-    let has_lexical_errors = tokens.iter().any(|token| token.class == TokenClass::Error);
-    let (declarations, has_unmatched_braces) =
-        declaration_outline(source, &tokens, limits.max_declarations)?;
-    Ok(Outline {
-        source,
-        tokens,
-        declarations,
-        has_lexical_errors,
-        has_unmatched_braces,
-    })
-}
-
-fn declaration_outline(
-    source: &str,
-    tokens: &[TokenSpan],
-    max_declarations: usize,
-) -> Result<(Vec<OutlineDeclaration>, bool), OutlineLimit> {
     let significant = tokens
         .iter()
         .filter(|t| !matches!(t.class, TokenClass::Whitespace | TokenClass::Comment))
@@ -2118,21 +1904,17 @@ fn declaration_outline(
     // again would make tolerant navigation quadratic on deeply nested drafts.
     let mut body_ends = vec![None; significant.len()];
     let mut bodies = Vec::new();
-    let mut unmatched_close = false;
     for (index, token) in significant.iter().enumerate() {
         match &source[token.span.start..token.span.end] {
             "{" => bodies.push(index),
             "}" => {
                 if let Some(open) = bodies.pop() {
                     body_ends[open] = Some(token.span.end);
-                } else {
-                    unmatched_close = true;
                 }
             }
             _ => {}
         }
     }
-    let has_unmatched_braces = unmatched_close || !bodies.is_empty();
     let mut declarations = Vec::new();
     for (i, t) in significant.iter().enumerate() {
         let word = &source[t.span.start..t.span.end];
@@ -2157,16 +1939,7 @@ fn declaration_outline(
             }
             j += 1;
         }
-        if declarations.len() == max_declarations {
-            return Err(OutlineLimit {
-                resource: OutlineResource::Declarations,
-                limit: max_declarations,
-                observed_at_least: declarations.len().saturating_add(1),
-                offset: t.span.start,
-            });
-        }
         let mut id = None;
-        let mut id_literal_span = None;
         if significant
             .get(j)
             .is_some_and(|t| &source[t.span.start..t.span.end] == "id")
@@ -2174,51 +1947,39 @@ fn declaration_outline(
             if let Some(value) = significant.get(j + 1)
                 && value.class == TokenClass::String
             {
-                id_literal_span = Some(value.span);
                 let text =
                     serde_json::from_str::<String>(&source[value.span.start..value.span.end])
                         .unwrap();
-                if has_uuid_header_shape(&text) {
-                    id = Id::parse_str(&text).ok();
-                }
+                id = Id::parse_str(&text).ok();
             }
             j += 2;
         }
-        // A recognized header ID at EOF must remain inside the whole span.
-        // Keep the old next-token/body behavior; only the EOF fallback changes.
-        let header_end = significant
-            .get(j.saturating_sub(1))
-            .or_else(|| significant.last())
-            .map_or(alias_token.span.end, |token| token.span.end);
-        let mut end = significant.get(j).map_or(header_end, |t| t.span.end);
+        let mut end = significant
+            .get(j)
+            .map_or(alias_token.span.end, |t| t.span.end);
         if significant
             .get(j)
             .is_some_and(|t| &source[t.span.start..t.span.end] == "{")
         {
             end = body_ends[j].unwrap_or(source.len());
         }
-        declarations.push(OutlineDeclaration {
-            declaration: DeclarationSpan {
-                alias: alias.into(),
-                id,
-                kind: word.into(),
-                span: Span {
-                    start: t.span.start,
-                    end,
-                },
+        declarations.push(DeclarationSpan {
+            alias: alias.into(),
+            id,
+            kind: word.into(),
+            span: Span {
+                start: t.span.start,
+                end,
             },
-            kind_span: t.span,
-            alias_span: alias_token.span,
-            id_literal_span,
         });
     }
-    Ok((declarations, has_unmatched_braces))
+    Analysis {
+        tokens,
+        diagnostics: lint(source),
+        declarations,
+    }
 }
 
-#[cfg(test)]
-#[path = "language_outline_tests.rs"]
-mod outline_tests;
-
 #[cfg(test)]
 #[path = "language_nesting_tests.rs"]
 mod nesting_tests;
@@ -2613,7 +2374,11 @@ pub(crate) mod legacy {
             let value = self.quoted()?;
             // Require the portable 8-4-4-4-12 spelling, not the UUID crate's URN,
             // braces, or compact alternatives. Uppercase hexadecimal is accepted.
-            if !super::has_uuid_header_shape(&value) {
+            if value.len() != 36
+                || ![8, 13, 18, 23]
+                    .into_iter()
+                    .all(|index| value.as_bytes()[index] == b'-')
+            {
                 return Err(Error {
                     code: "invalid_source",
                     offset,

crates/oa-core/src/language/analysis_source.rs

@@ -0,0 +1,113 @@
+//! Unresolved typed source8 syntax, staged for the complete source adapter.
+//! This module does not admit a Project or enable public source8.
+mod budget;
+mod cursor;
+mod declarations;
+mod lex;
+mod lower;
+mod syntax;
+mod write;
+
+#[cfg(test)]
+mod model_oracle;
+
+use super::Span;
+use crate::analysis::{BinaryOp, UnaryOp};
+use crate::analysis_numeric::Exact;
+use budget::Budget;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Error {
+    pub span: Span,
+    pub message: String,
+}
+fn error(span: Span, message: impl Into<String>) -> Error {
+    Error {
+        span,
+        message: message.into(),
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Reference {
+    pub name: String,
+    pub span: Span,
+}
+#[derive(Debug, PartialEq, Eq)]
+pub struct Argument {
+    pub parameter: Reference,
+    pub value: Expression,
+}
+#[derive(Debug, PartialEq, Eq)]
+pub struct Expression {
+    pub kind: ExpressionKind,
+    pub span: Span,
+    pub depth: usize,
+    pub grouped: bool,
+    /// Original numeric tokens, including constructor punctuation, excluding
+    /// trivia. The full span retains intervening comments and spelling.
+    pub literal: Option<LiteralSyntax>,
+}
+#[derive(Debug, PartialEq, Eq)]
+pub struct LiteralSyntax {
+    pub span: Span,
+    pub tokens: Vec<Span>,
+}
+#[derive(Debug, PartialEq, Eq)]
+pub enum ExpressionKind {
+    Boolean(bool),
+    Number(Exact),
+    Quantity {
+        magnitude: Exact,
+        unit: Reference,
+    },
+    Property(Reference),
+    Parameter(Reference),
+    List(Vec<Expression>),
+    Unary {
+        op: UnaryOp,
+        operand: Box<Expression>,
+    },
+    Binary {
+        op: BinaryOp,
+        left: Box<Expression>,
+        right: Box<Expression>,
+    },
+    If {
+        condition: Box<Expression>,
+        when_true: Box<Expression>,
+        when_false: Box<Expression>,
+    },
+    Call {
+        definition: Reference,
+        arguments: Vec<Argument>,
+    },
+    Sum {
+        values: Box<Expression>,
+        initial: Box<Expression>,
+    },
+    Power {
+        base: Box<Expression>,
+        exponent: i8,
+    },
+    AsKind {
+        kind: Reference,
+        value: Box<Expression>,
+    },
+}
+#[derive(Debug, PartialEq, Eq)]
+pub enum Binding {
+    Unbound(Span),
+    Expression(Expression),
+}
+
+pub fn parse(source: &str, budget: &mut Budget) -> Result<Binding, Error> {
+    let tokens = lex::tokens(source, budget)?;
+    let mut cursor = cursor::Cursor::new(source, &tokens, budget);
+    let binding = syntax::binding(&mut cursor)?;
+    cursor.end()?;
+    Ok(binding)
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/budget.rs

@@ -0,0 +1,154 @@
+//! Candidate limits for measured adoption; one owner spans all parsed files.
+use super::{Error, Span, error};
+use crate::analysis_numeric::{Exact, WorkLimits, WorkMeter};
+use crate::language::ParseLimits;
+
+#[derive(Clone, Copy, Debug)]
+pub struct Limits {
+    pub bytes: usize,
+    pub tokens: usize,
+    pub entries: usize,
+    pub references: usize,
+    pub frames: usize,
+    pub numeric_units: u64,
+}
+impl Limits {
+    pub fn source8(caller: ParseLimits) -> Self {
+        let bytes = caller.max_source_bytes.min(64 * 1024 * 1024);
+        Self {
+            bytes,
+            tokens: bytes.min(1_048_576),
+            entries: caller.max_records.min(262_144),
+            references: caller.max_step_references.min(500_000),
+            frames: 256,
+            numeric_units: 50_000_000,
+        }
+    }
+}
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct Usage {
+    pub bytes: usize,
+    pub tokens: usize,
+    pub entries: usize,
+    pub references: usize,
+    pub deepest_frame: usize,
+}
+pub struct Budget {
+    limits: Limits,
+    pub usage: Usage,
+    numeric: WorkMeter,
+    failed: Option<Error>,
+}
+impl Budget {
+    pub fn new(limits: Limits) -> Result<Self, Error> {
+        let hard = Limits::source8(ParseLimits::UNLIMITED);
+        if limits.bytes > hard.bytes
+            || limits.tokens > hard.tokens
+            || limits.entries > hard.entries
+            || limits.references > hard.references
+            || limits.frames > hard.frames
+            || limits.numeric_units > hard.numeric_units
+        {
+            return Err(error(
+                Span::default(),
+                "Source8 profile cannot exceed candidate hard limits.",
+            ));
+        }
+        Ok(Self {
+            limits,
+            usage: Usage::default(),
+            numeric: WorkMeter::new(
+                WorkLimits::new(0, limits.numeric_units)
+                    .map_err(|e| error(Span::default(), e.to_string()))?,
+            ),
+            failed: None,
+        })
+    }
+    pub fn active(&self) -> Result<(), Error> {
+        self.failed.clone().map_or(Ok(()), Err)
+    }
+    fn charge(
+        &mut self,
+        used: usize,
+        amount: usize,
+        maximum: usize,
+        span: Span,
+        name: &str,
+    ) -> Result<(), Error> {
+        self.active()?;
+        if amount > maximum.saturating_sub(used) {
+            let failure = error(span, format!("Source8 {name} limit exceeded."));
+            self.failed = Some(failure.clone());
+            return Err(failure);
+        }
+        Ok(())
+    }
+    pub fn bytes(&mut self, amount: usize, span: Span) -> Result<(), Error> {
+        self.charge(self.usage.bytes, amount, self.limits.bytes, span, "bytes")?;
+        self.usage.bytes += amount;
+        Ok(())
+    }
+    pub fn token(&mut self, span: Span) -> Result<(), Error> {
+        self.charge(self.usage.tokens, 1, self.limits.tokens, span, "tokens")?;
+        self.usage.tokens += 1;
+        Ok(())
+    }
+    pub fn entry(&mut self, span: Span) -> Result<(), Error> {
+        self.charge(
+            self.usage.entries,
+            1,
+            self.limits.entries,
+            span,
+            "syntax entries",
+        )?;
+        self.usage.entries += 1;
+        Ok(())
+    }
+    pub fn reference(&mut self, span: Span) -> Result<(), Error> {
+        self.charge(
+            self.usage.references,
+            1,
+            self.limits.references,
+            span,
+            "references",
+        )?;
+        self.usage.references += 1;
+        Ok(())
+    }
+    pub fn frame(&mut self, depth: usize, span: Span) -> Result<(), Error> {
+        self.charge(0, depth, self.limits.frames, span, "syntax frames")?;
+        self.usage.deepest_frame = self.usage.deepest_frame.max(depth);
+        Ok(())
+    }
+    pub fn exact(&mut self, spelling: &str, span: Span) -> Result<Exact, Error> {
+        self.active()?;
+        match Exact::parse_literal(spelling, &mut self.numeric) {
+            Ok(value) => Ok(value),
+            Err(cause) => {
+                let failure = error(span, cause.to_string());
+                self.failed = Some(failure.clone());
+                Err(failure)
+            }
+        }
+    }
+    pub fn numeric_units(&self) -> u64 {
+        self.numeric.usage().numeric_units
+    }
+    /// Check phase allocation bounds without recharging parsed syntax or exact
+    /// work. S4 must also charge ordinary records through the inherited budget.
+    pub fn lowering_entries(&self, count: usize, span: Span) -> Result<(), Error> {
+        self.active()?;
+        if count > self.limits.entries {
+            return Err(error(span, "Source8 lowering entry limit exceeded."));
+        }
+        Ok(())
+    }
+    pub fn lowering_occurrences(&self, count: usize, span: Span) -> Result<(), Error> {
+        self.active()?;
+        // Parameter declarations are syntax entries, not reference uses.
+        if count > self.limits.references.saturating_add(self.limits.entries) {
+            return Err(error(span, "Source8 lowering occurrence limit exceeded."));
+        }
+        Ok(())
+    }
+}

crates/oa-core/src/language/analysis_source/cursor.rs

@@ -0,0 +1,171 @@
+//! A borrowed significant-token cursor. Spans always refer to the full source.
+use super::*;
+use lex::{Class, Token};
+
+pub(super) struct Cursor<'a, 'b> {
+    pub source: &'a str,
+    pub tokens: &'a [Token],
+    pub cursor: usize,
+    pub frames: usize,
+    pub budget: &'b mut Budget,
+}
+impl<'a, 'b> Cursor<'a, 'b> {
+    pub(super) fn new(source: &'a str, tokens: &'a [Token], budget: &'b mut Budget) -> Self {
+        Self {
+            source,
+            tokens,
+            cursor: 0,
+            frames: 0,
+            budget,
+        }
+    }
+}
+impl Cursor<'_, '_> {
+    pub(super) fn span(&self) -> Span {
+        self.tokens.get(self.cursor).map_or(
+            Span {
+                start: self.source.len(),
+                end: self.source.len(),
+            },
+            |token| token.span,
+        )
+    }
+    pub(super) fn text(&self) -> &str {
+        let span = self.span();
+        &self.source[span.start..span.end]
+    }
+    pub(super) fn take(&mut self, expected: &str) -> Result<Span, Error> {
+        if self.text() != expected {
+            return Err(error(self.span(), format!("Expected '{expected}'.")));
+        }
+        let span = self.span();
+        self.cursor += 1;
+        Ok(span)
+    }
+    pub(super) fn end(&self) -> Result<(), Error> {
+        if self.cursor != self.tokens.len() {
+            Err(error(
+                self.span(),
+                "Unexpected content after analysis expression.",
+            ))
+        } else {
+            Ok(())
+        }
+    }
+    pub(super) fn open(&mut self) -> Result<(), Error> {
+        self.budget.frame(self.frames + 1, self.span())?;
+        self.frames += 1;
+        Ok(())
+    }
+    pub(super) fn close(&mut self) {
+        self.frames -= 1;
+    }
+    pub(super) fn reference(&mut self) -> Result<Reference, Error> {
+        self.budget.reference(self.span())?;
+        self.name()
+    }
+    pub(super) fn name(&mut self) -> Result<Reference, Error> {
+        let span = self.span();
+        if !self
+            .tokens
+            .get(self.cursor)
+            .is_some_and(|token| token.class == Class::Word)
+            || !crate::valid_alias(self.text())
+        {
+            return Err(error(span, "Expected a valid reference or parameter name."));
+        }
+        let name = self.text().to_owned();
+        self.cursor += 1;
+        Ok(Reference { name, span })
+    }
+    pub(super) fn quoted(&mut self) -> Result<String, Error> {
+        let span = self.span();
+        if !self
+            .tokens
+            .get(self.cursor)
+            .is_some_and(|token| token.class == Class::String)
+        {
+            return Err(error(span, "Expected a quoted string."));
+        }
+        let value =
+            serde_json::from_str(self.text()).map_err(|_| error(span, "Invalid quoted string."))?;
+        self.cursor += 1;
+        Ok(value)
+    }
+    pub(super) fn last_end(&self) -> usize {
+        self.tokens[self.cursor - 1].span.end
+    }
+    pub(super) fn exact_literal(&mut self) -> Result<(Exact, LiteralSyntax), Error> {
+        if self.text() == "ratio" {
+            return self.ratio();
+        }
+        let span = self.span();
+        if !self
+            .tokens
+            .get(self.cursor)
+            .is_some_and(|token| token.class == Class::Number)
+        {
+            return Err(error(span, "Expected an exact numeric atom or ratio."));
+        }
+        let value = self
+            .budget
+            .exact(&self.source[span.start..span.end], span)?;
+        self.cursor += 1;
+        Ok((
+            value,
+            LiteralSyntax {
+                span,
+                tokens: vec![span],
+            },
+        ))
+    }
+    pub(super) fn integer(&mut self) -> Result<Span, Error> {
+        let span = self.span();
+        let text = self.text();
+        if text.is_empty() || !text.bytes().all(|b| b.is_ascii_digit()) {
+            return Err(error(span, "Expected unsigned integer digits."));
+        }
+        if text.len() > crate::analysis_numeric::MAX_COMPONENT_DIGITS {
+            return Err(error(span, "Integer component exceeds digit limit."));
+        }
+        self.cursor += 1;
+        Ok(span)
+    }
+    pub(super) fn ratio(&mut self) -> Result<(Exact, LiteralSyntax), Error> {
+        let first_token = self.cursor;
+        let start = self.take("ratio")?.start;
+        self.open()?;
+        self.take("(")?;
+        let negative = if self.text() == "-" {
+            self.cursor += 1;
+            true
+        } else {
+            false
+        };
+        let numerator = self.integer()?;
+        self.take(",")?;
+        let denominator = self.integer()?;
+        let end = self.take(")")?.end;
+        self.close();
+        let n = &self.source[numerator.start..numerator.end];
+        let d = &self.source[denominator.start..denominator.end];
+        let length = 9 + usize::from(negative) + n.len() + d.len();
+        if length > crate::analysis_numeric::MAX_LITERAL_BYTES {
+            return Err(error(
+                Span { start, end },
+                "Numeric reconstruction exceeds literal byte limit.",
+            ));
+        }
+        let normalized = format!("ratio({}{n}, {d})", if negative { "-" } else { "" });
+        Ok((
+            self.budget.exact(&normalized, Span { start, end })?,
+            LiteralSyntax {
+                span: Span { start, end },
+                tokens: self.tokens[first_token..self.cursor]
+                    .iter()
+                    .map(|token| token.span)
+                    .collect(),
+            },
+        ))
+    }
+}

crates/oa-core/src/language/analysis_source/declarations.rs

@@ -0,0 +1,635 @@
+//! Required typed declaration syntax. No model construction or resolution.
+use super::cursor::Cursor;
+use super::*;
+use crate::{Id, Layer};
+use std::collections::BTreeSet;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DeclarationKind {
+    QuantityKind,
+    Unit,
+    Calculation,
+    Property(Layer),
+    Check(Layer),
+    Case(Layer),
+}
+
+/// Contextual recognition only: never add these words to the global alias ban.
+pub fn declaration_kind(word: &str) -> Option<DeclarationKind> {
+    use DeclarationKind::*;
+    Some(match word {
+        "quantity_kind" => QuantityKind,
+        "unit" => Unit,
+        "calculation" => Calculation,
+        "oa_property" => Property(Layer::Oa),
+        "sa_property" => Property(Layer::Sa),
+        "oa_check" => Check(Layer::Oa),
+        "sa_check" => Check(Layer::Sa),
+        "oa_analysis" => Case(Layer::Oa),
+        "sa_analysis" => Case(Layer::Sa),
+        _ => return None,
+    })
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct IdentitySyntax {
+    /// Missing IDs stay unresolved here. The bundle stabilization owner assigns
+    /// and inserts an ID once, then reparses the actual returned bytes.
+    pub value: Option<Id>,
+    pub keyword: Option<Span>,
+    pub literal: Option<Span>,
+    pub insertion: Option<usize>,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Header {
+    pub kind: DeclarationKind,
+    pub kind_span: Span,
+    pub alias: Reference,
+    pub name: String,
+    pub name_span: Span,
+    pub identity: IdentitySyntax,
+    pub span: Span,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Field<T> {
+    /// Complete field including its keyword and trailing semicolon.
+    pub span: Span,
+    pub keyword: Span,
+    /// Same meaning as an ordinary top-level field value span.
+    pub value_span: Span,
+    pub value: T,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct ScalarSyntax {
+    pub span: Span,
+    pub kind: ScalarKind,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum ScalarKind {
+    Boolean,
+    Number,
+    Quantity(Reference),
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct TypeSyntax {
+    pub span: Span,
+    pub scalar: ScalarSyntax,
+    pub list: bool,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct ParameterSyntax {
+    pub span: Span,
+    pub name: Reference,
+    pub identity: IdentitySyntax,
+    pub value_type: TypeSyntax,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct DimensionEntry {
+    pub axis: Span,
+    pub exponent: Span,
+    pub span: Span,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct DimensionSyntax {
+    pub exponents: [i16; 7],
+    pub entries: Vec<DimensionEntry>,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum AlgebraSyntax {
+    Linear,
+    Affine(Reference),
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct ExactSyntax {
+    pub value: Exact,
+    pub literal: LiteralSyntax,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct OverrideSyntax {
+    pub span: Span,
+    pub target: Reference,
+    pub binding: Binding,
+    pub binding_span: Span,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum Body {
+    QuantityKind {
+        dimension: Field<DimensionSyntax>,
+        algebra: Field<AlgebraSyntax>,
+    },
+    Unit {
+        kind: Field<Reference>,
+        scale: Field<ExactSyntax>,
+        offset: Field<ExactSyntax>,
+        symbol: Field<String>,
+    },
+    Calculation {
+        parameters: Vec<ParameterSyntax>,
+        result: Field<TypeSyntax>,
+        body: Field<Binding>,
+    },
+    Property {
+        subject: Field<Reference>,
+        value_type: Field<TypeSyntax>,
+        base: Field<Binding>,
+        display_unit: Option<Field<Option<Reference>>>,
+    },
+    Check {
+        subject: Option<Field<Option<Reference>>>,
+        documented_constraint: Option<Field<Option<Reference>>>,
+        predicate: Field<Binding>,
+    },
+    Case {
+        subject: Option<Field<Option<Reference>>>,
+        base: Field<()>,
+        overrides: Field<Vec<OverrideSyntax>>,
+    },
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Declaration {
+    pub header: Header,
+    pub span: Span,
+    pub body_span: Span,
+    pub description: Option<Field<String>>,
+    /// Analysis roots may explicitly spell `parent none`; definitions may not.
+    pub parent: Option<Field<()>>,
+    pub body: Body,
+}
+
+#[derive(Default)]
+struct Fields {
+    dimension: Option<Field<DimensionSyntax>>,
+    algebra: Option<Field<AlgebraSyntax>>,
+    kind: Option<Field<Reference>>,
+    scale: Option<Field<ExactSyntax>>,
+    offset: Option<Field<ExactSyntax>>,
+    symbol: Option<Field<String>>,
+    result: Option<Field<TypeSyntax>>,
+    body: Option<Field<Binding>>,
+    subject: Option<Field<Reference>>,
+    optional_subject: Option<Field<Option<Reference>>>,
+    value_type: Option<Field<TypeSyntax>>,
+    base: Option<Field<Binding>>,
+    display_unit: Option<Field<Option<Reference>>>,
+    documented_constraint: Option<Field<Option<Reference>>>,
+    predicate: Option<Field<Binding>>,
+    baseline: Option<Field<()>>,
+    overrides: Option<Field<Vec<OverrideSyntax>>>,
+}
+
+fn required<T>(value: Option<T>, name: &str, at: Span) -> Result<T, Error> {
+    value.ok_or_else(|| error(at, format!("Missing required field '{name}'.")))
+}
+
+impl Fields {
+    fn finish(
+        self,
+        kind: DeclarationKind,
+        parameters: Vec<ParameterSyntax>,
+        at: Span,
+    ) -> Result<Body, Error> {
+        Ok(match kind {
+            DeclarationKind::QuantityKind => Body::QuantityKind {
+                dimension: required(self.dimension, "dimension", at)?,
+                algebra: required(self.algebra, "algebra", at)?,
+            },
+            DeclarationKind::Unit => Body::Unit {
+                kind: required(self.kind, "kind", at)?,
+                scale: required(self.scale, "scale", at)?,
+                offset: required(self.offset, "offset", at)?,
+                symbol: required(self.symbol, "symbol", at)?,
+            },
+            DeclarationKind::Calculation => Body::Calculation {
+                parameters,
+                result: required(self.result, "result", at)?,
+                body: required(self.body, "body", at)?,
+            },
+            DeclarationKind::Property(_) => Body::Property {
+                subject: required(self.subject, "subject", at)?,
+                value_type: required(self.value_type, "type", at)?,
+                base: required(self.base, "base", at)?,
+                display_unit: self.display_unit,
+            },
+            DeclarationKind::Check(_) => Body::Check {
+                subject: self.optional_subject,
+                documented_constraint: self.documented_constraint,
+                predicate: required(self.predicate, "predicate", at)?,
+            },
+            DeclarationKind::Case(_) => Body::Case {
+                subject: self.optional_subject,
+                base: required(self.baseline, "base", at)?,
+                overrides: required(self.overrides, "overrides", at)?,
+            },
+        })
+    }
+}
+
+/// Consume exactly one declaration from already charged full-file tokens.
+/// `version` is inherited from the caller's entry policy; fragments have no
+/// independent version header. Public parsing does not call this staged API.
+pub(super) fn parse(
+    p: &mut Cursor<'_, '_>,
+    version: u32,
+    lexical_owner: Option<Id>,
+) -> Result<Declaration, Error> {
+    p.budget.active()?;
+    let kind_span = p.span();
+    let kind = declaration_kind(p.text())
+        .ok_or_else(|| error(kind_span, "Expected a short typed declaration word."))?;
+    if version != 8 {
+        return Err(error(kind_span, "Analysis declarations require source8."));
+    }
+    if lexical_owner.is_some() {
+        return Err(error(
+            kind_span,
+            "Analysis declarations and definitions must be roots.",
+        ));
+    }
+    p.budget.entry(kind_span)?;
+    p.cursor += 1;
+    let alias = p.name()?;
+    let name_span = p.span();
+    let name = p.quoted()?;
+    let identity = p.identity()?;
+    p.open()?;
+    let opening = p.take("{")?;
+    let header = Header {
+        kind,
+        kind_span,
+        alias,
+        name,
+        name_span,
+        identity,
+        span: Span {
+            start: kind_span.start,
+            end: opening.start,
+        },
+    };
+    let mut fields = Fields::default();
+    let mut description = None;
+    let mut parent = None;
+    let mut parameters = Vec::new();
+    let mut seen = BTreeSet::new();
+    let mut parameter_names = BTreeSet::new();
+    let mut parameter_ids = BTreeSet::new();
+    while p.text() != "}" {
+        let keyword = p.span();
+        p.budget.entry(keyword)?;
+        if p.text() == "input" && kind == DeclarationKind::Calculation {
+            let parameter = p.parameter()?;
+            if !parameter_names.insert(parameter.name.name.clone()) {
+                return Err(error(parameter.name.span, "Duplicate parameter name."));
+            }
+            if let Some(id) = parameter.identity.value
+                && !parameter_ids.insert(id)
+            {
+                return Err(error(
+                    parameter.identity.literal.expect("explicit identity"),
+                    "Duplicate parameter identity.",
+                ));
+            }
+            parameters.push(parameter);
+            continue;
+        }
+        // Borrow the original spelling for duplicate detection; no field-name
+        // allocation and no map insertion can overwrite an earlier value.
+        let source = p.source;
+        let key = &source[keyword.start..keyword.end];
+        if !seen.insert(key) {
+            return Err(error(keyword, format!("Duplicate field '{key}'.")));
+        }
+        p.cursor += 1;
+        use DeclarationKind::*;
+        match (kind, key) {
+            (_, "description") => description = Some(p.field(keyword, |p| p.quoted())?),
+            (Property(_) | Check(_) | Case(_), "parent") => {
+                parent = Some(p.field(keyword, |p| {
+                    p.take("none")?;
+                    Ok(())
+                })?)
+            }
+            (QuantityKind, "dimension") => {
+                fields.dimension = Some(p.field(keyword, |p| p.dimension())?)
+            }
+            (QuantityKind, "algebra") => fields.algebra = Some(p.field(keyword, |p| p.algebra())?),
+            (Unit, "kind") => fields.kind = Some(p.field(keyword, |p| p.at_reference())?),
+            (Unit, "scale") => fields.scale = Some(p.field(keyword, |p| p.exact_value())?),
+            (Unit, "offset") => fields.offset = Some(p.field(keyword, |p| p.exact_value())?),
+            (Unit, "symbol") => fields.symbol = Some(p.field(keyword, |p| p.quoted())?),
+            (Calculation, "result") => fields.result = Some(p.field(keyword, |p| p.value_type())?),
+            (Calculation, "body") => fields.body = Some(p.field(keyword, syntax::binding)?),
+            (Property(_), "subject") => {
+                fields.subject = Some(p.field(keyword, |p| p.at_reference())?)
+            }
+            (Property(_), "type") => {
+                fields.value_type = Some(p.field(keyword, |p| p.value_type())?)
+            }
+            (Property(_), "base") => fields.base = Some(p.field(keyword, syntax::binding)?),
+            (Property(_), "display_unit") => {
+                fields.display_unit = Some(p.field(keyword, |p| p.optional_reference())?)
+            }
+            (Check(_) | Case(_), "subject") => {
+                fields.optional_subject = Some(p.field(keyword, |p| p.optional_reference())?)
+            }
+            (Check(_), "documented_constraint") => {
+                fields.documented_constraint = Some(p.field(keyword, |p| p.optional_reference())?)
+            }
+            (Check(_), "predicate") => fields.predicate = Some(p.field(keyword, syntax::binding)?),
+            (Case(_), "base") => {
+                fields.baseline = Some(p.field(keyword, |p| {
+                    p.take("ModelBaseline")?;
+                    Ok(())
+                })?)
+            }
+            (Case(_), "overrides") => fields.overrides = Some(p.field(keyword, |p| p.overrides())?),
+            _ => {
+                return Err(error(
+                    keyword,
+                    format!("Unknown field '{key}' for this typed declaration."),
+                ));
+            }
+        }
+    }
+    let closing = p.take("}")?;
+    p.close();
+    let body = fields.finish(kind, parameters, closing)?;
+    Ok(Declaration {
+        header,
+        span: Span {
+            start: kind_span.start,
+            end: closing.end,
+        },
+        body_span: Span {
+            start: opening.end,
+            end: closing.start,
+        },
+        description,
+        parent,
+        body,
+    })
+}
+
+impl Cursor<'_, '_> {
+    fn field<T>(
+        &mut self,
+        keyword: Span,
+        parse: impl FnOnce(&mut Self) -> Result<T, Error>,
+    ) -> Result<Field<T>, Error> {
+        let start = self.span().start;
+        let value = parse(self)?;
+        let end = self.last_end();
+        let terminator = self.take(";")?;
+        Ok(Field {
+            span: Span {
+                start: keyword.start,
+                end: terminator.end,
+            },
+            keyword,
+            value_span: Span { start, end },
+            value,
+        })
+    }
+
+    fn identity(&mut self) -> Result<IdentitySyntax, Error> {
+        if self.text() != "id" {
+            return Ok(IdentitySyntax {
+                value: None,
+                keyword: None,
+                literal: None,
+                insertion: Some(self.span().start),
+            });
+        }
+        let keyword = self.take("id")?;
+        let literal = self.span();
+        let spelling = self.quoted()?;
+        if spelling.len() != 36
+            || ![8, 13, 18, 23]
+                .into_iter()
+                .all(|at| spelling.as_bytes()[at] == b'-')
+        {
+            return Err(error(
+                literal,
+                "Expected UUID in 8-4-4-4-12 hexadecimal form.",
+            ));
+        }
+        let id = Id::parse_str(&spelling).map_err(|_| error(literal, "Invalid UUID identity."))?;
+        Ok(IdentitySyntax {
+            value: Some(id),
+            keyword: Some(keyword),
+            literal: Some(literal),
+            insertion: None,
+        })
+    }
+
+    fn parameter(&mut self) -> Result<ParameterSyntax, Error> {
+        let start = self.take("input")?.start;
+        let name = self.name()?;
+        let identity = self.identity()?;
+        self.take(":")?;
+        let value_type = self.value_type()?;
+        let end = self.take(";")?.end;
+        Ok(ParameterSyntax {
+            span: Span { start, end },
+            name,
+            identity,
+            value_type,
+        })
+    }
+
+    fn at_reference(&mut self) -> Result<Reference, Error> {
+        self.take("@")?;
+        self.reference()
+    }
+
+    fn optional_reference(&mut self) -> Result<Option<Reference>, Error> {
+        if self.text() == "none" {
+            self.cursor += 1;
+            Ok(None)
+        } else {
+            self.at_reference().map(Some)
+        }
+    }
+
+    fn exact_value(&mut self) -> Result<ExactSyntax, Error> {
+        let (value, literal) = self.exact_literal()?;
+        Ok(ExactSyntax { value, literal })
+    }
+
+    fn value_type(&mut self) -> Result<TypeSyntax, Error> {
+        let start = self.span().start;
+        self.budget.entry(self.span())?;
+        let list = self.text() == "List";
+        if list {
+            self.open()?;
+            self.cursor += 1;
+            self.take("(")?;
+        }
+        let scalar = self.scalar_type()?;
+        if list {
+            self.take(")")?;
+            self.close();
+        }
+        Ok(TypeSyntax {
+            span: Span {
+                start,
+                end: self.last_end(),
+            },
+            scalar,
+            list,
+        })
+    }
+
+    fn scalar_type(&mut self) -> Result<ScalarSyntax, Error> {
+        let start = self.span().start;
+        let kind = match self.text() {
+            "Boolean" => {
+                self.cursor += 1;
+                ScalarKind::Boolean
+            }
+            "Number" => {
+                self.cursor += 1;
+                ScalarKind::Number
+            }
+            "Quantity" => {
+                self.open()?;
+                self.cursor += 1;
+                self.take("(")?;
+                let reference = self.at_reference()?;
+                self.take(")")?;
+                self.close();
+                ScalarKind::Quantity(reference)
+            }
+            _ => {
+                return Err(error(
+                    self.span(),
+                    "Expected Boolean, Number or Quantity(@kind); nested List is not a scalar type.",
+                ));
+            }
+        };
+        Ok(ScalarSyntax {
+            span: Span {
+                start,
+                end: self.last_end(),
+            },
+            kind,
+        })
+    }
+
+    fn dimension(&mut self) -> Result<DimensionSyntax, Error> {
+        self.open()?;
+        self.take("{")?;
+        let mut exponents = [0; 7];
+        let mut seen = [false; 7];
+        let mut entries = Vec::new();
+        while self.text() != "}" {
+            let axis = self.span();
+            self.budget.entry(axis)?;
+            let index = match self.text() {
+                "length" => 0,
+                "mass" => 1,
+                "time" => 2,
+                "electric_current" => 3,
+                "temperature" => 4,
+                "amount" => 5,
+                "luminous_intensity" => 6,
+                _ => return Err(error(axis, "Unknown dimension axis.")),
+            };
+            if seen[index] {
+                return Err(error(axis, "Duplicate dimension axis."));
+            }
+            seen[index] = true;
+            self.cursor += 1;
+            let start = self.span().start;
+            let negative = self.text() == "-";
+            if negative {
+                self.cursor += 1;
+            }
+            let digits = self.integer()?;
+            let value = self.source[digits.start..digits.end]
+                .parse::<i16>()
+                .map_err(|_| error(digits, "Dimension exponent exceeds -32..32."))?;
+            if value > 32 {
+                return Err(error(digits, "Dimension exponent exceeds -32..32."));
+            }
+            exponents[index] = if negative { -value } else { value };
+            let exponent = Span {
+                start,
+                end: digits.end,
+            };
+            let end = self.take(";")?.end;
+            entries.push(DimensionEntry {
+                axis,
+                exponent,
+                span: Span {
+                    start: axis.start,
+                    end,
+                },
+            });
+        }
+        self.take("}")?;
+        self.close();
+        Ok(DimensionSyntax { exponents, entries })
+    }
+
+    fn algebra(&mut self) -> Result<AlgebraSyntax, Error> {
+        if self.text() == "Linear" {
+            self.cursor += 1;
+            return Ok(AlgebraSyntax::Linear);
+        }
+        self.take("Affine")?;
+        self.open()?;
+        self.take("(")?;
+        let difference = self.at_reference()?;
+        self.take(")")?;
+        self.close();
+        Ok(AlgebraSyntax::Affine(difference))
+    }
+
+    fn overrides(&mut self) -> Result<Vec<OverrideSyntax>, Error> {
+        self.open()?;
+        self.take("{")?;
+        let mut entries = Vec::new();
+        let mut names = BTreeSet::new();
+        while self.text() != "}" {
+            let start = self.span().start;
+            self.budget.entry(self.span())?;
+            let target = self.at_reference()?;
+            if !names.insert(target.name.clone()) {
+                return Err(error(target.span, "Duplicate override target."));
+            }
+            self.take("=")?;
+            let binding_start = self.span().start;
+            let binding = syntax::binding(self)?;
+            let binding_span = Span {
+                start: binding_start,
+                end: self.last_end(),
+            };
+            let end = self.take(";")?.end;
+            entries.push(OverrideSyntax {
+                span: Span { start, end },
+                target,
+                binding,
+                binding_span,
+            });
+        }
+        self.take("}")?;
+        self.close();
+        Ok(entries)
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/declarations/tests.rs

@@ -0,0 +1,613 @@
+use super::*;
+use crate::language::ParseLimits;
+use crate::language::analysis_source::budget::Limits;
+
+fn limits() -> Limits {
+    Limits::source8(ParseLimits::UNLIMITED)
+}
+fn budget() -> Budget {
+    Budget::new(limits()).unwrap()
+}
+
+fn declaration(source: &str) -> Declaration {
+    let mut budget = budget();
+    let tokens = lex::tokens(source, &mut budget).unwrap();
+    let mut cursor = Cursor::new(source, &tokens, &mut budget);
+    let result = parse(&mut cursor, 8, None).unwrap();
+    cursor.end().unwrap();
+    result
+}
+
+fn failure(source: &str) -> Error {
+    let mut budget = budget();
+    let tokens = lex::tokens(source, &mut budget).unwrap();
+    parse(&mut Cursor::new(source, &tokens, &mut budget), 8, None).unwrap_err()
+}
+
+fn text(source: &str, span: Span) -> &str {
+    &source[span.start..span.end]
+}
+
+#[test]
+fn required_declarations_have_independent_typed_body_and_header_oracles() {
+    let source = "quantity_kind duration \"Duration\" id \"188b911c-5f8b-431c-9eea-2d41f3953767\" { dimension { time 1; length -2; }; algebra Affine(@difference); description \"雪\"; }";
+    let actual = declaration(source);
+    assert_eq!(actual.header.kind, DeclarationKind::QuantityKind);
+    assert_eq!(actual.header.alias.name, "duration");
+    assert_eq!(actual.header.name, "Duration");
+    assert_eq!(
+        actual.header.identity.value,
+        Some(Id::parse_str("188b911c-5f8b-431c-9eea-2d41f3953767").unwrap())
+    );
+    assert_eq!(actual.description.as_ref().unwrap().value, "雪");
+    assert!(actual.parent.is_none());
+    let Body::QuantityKind { dimension, algebra } = actual.body else {
+        panic!("quantity kind")
+    };
+    assert_eq!(dimension.value.exponents, [-2, 0, 1, 0, 0, 0, 0]);
+    assert_eq!(text(source, dimension.keyword), "dimension");
+    assert_eq!(text(source, dimension.value_span), "{ time 1; length -2; }");
+    assert_eq!(text(source, dimension.value.entries[1].exponent), "-2");
+    let AlgebraSyntax::Affine(difference) = algebra.value else {
+        panic!("affine")
+    };
+    assert_eq!(difference.name, "difference");
+
+    let Body::Unit { kind, scale, offset, symbol } = declaration("unit millisecond \"Millisecond\" { kind @duration; scale ratio (1, // divisor\n 1000); offset 0; symbol \"ms\"; }").body else { panic!("unit") };
+    assert_eq!(kind.value.name, "duration");
+    assert_eq!(scale.value.value.canonical_literal(), "ratio(1, 1000)");
+    assert_eq!(offset.value.value.canonical_literal(), "0");
+    assert_eq!(symbol.value, "ms");
+
+    let Body::Calculation { parameters, result, body } = declaration("calculation combine \"Combine durations\" { input a id \"28ff40b0-1b8f-4735-8536-5a6ab21b56cb\" : Quantity(@duration); input b id \"7a47cc1e-8ae5-4551-b2d8-8a68108e0976\" : Quantity(@duration); result Quantity(@duration); body $a + $b; }").body else { panic!("calculation") };
+    assert_eq!(
+        parameters
+            .iter()
+            .map(|p| p.name.name.as_str())
+            .collect::<Vec<_>>(),
+        ["a", "b"]
+    );
+    assert!(!result.value.list);
+    assert!(
+        matches!(result.value.scalar.kind, ScalarKind::Quantity(ref r) if r.name == "duration")
+    );
+    let Binding::Expression(Expression {
+        kind: ExpressionKind::Binary { op, left, right },
+        ..
+    }) = body.value
+    else {
+        panic!("binary")
+    };
+    assert_eq!(op, BinaryOp::Add);
+    assert!(matches!(left.kind, ExpressionKind::Parameter(ref r) if r.name == "a"));
+    assert!(matches!(right.kind, ExpressionKind::Parameter(ref r) if r.name == "b"));
+
+    for (word, layer) in [("oa_property", Layer::Oa), ("sa_property", Layer::Sa)] {
+        let actual = declaration(&format!(
+            "{word} receive_time \"Receive time\" {{ subject @receive; type Quantity(@duration); base 750 [@millisecond]; display_unit @millisecond; parent none; }}"
+        ));
+        assert_eq!(actual.header.kind, DeclarationKind::Property(layer));
+        assert!(actual.parent.is_some());
+        let Body::Property {
+            subject,
+            value_type,
+            base,
+            display_unit,
+        } = actual.body
+        else {
+            panic!("property")
+        };
+        assert_eq!(subject.value.name, "receive");
+        assert!(matches!(
+            value_type.value.scalar.kind,
+            ScalarKind::Quantity(_)
+        ));
+        assert!(matches!(
+            base.value,
+            Binding::Expression(Expression {
+                kind: ExpressionKind::Quantity { .. },
+                ..
+            })
+        ));
+        assert_eq!(display_unit.unwrap().value.unwrap().name, "millisecond");
+    }
+    for word in ["oa_check", "sa_check"] {
+        let Body::Check { subject, documented_constraint, predicate } = declaration(&format!("{word} budget \"Response budget\" {{ subject none; documented_constraint @constraint; predicate @total_time <= @limit; }}")).body else { panic!("check") };
+        assert!(subject.unwrap().value.is_none());
+        assert_eq!(
+            documented_constraint.unwrap().value.unwrap().name,
+            "constraint"
+        );
+        assert!(matches!(
+            predicate.value,
+            Binding::Expression(Expression {
+                kind: ExpressionKind::Binary {
+                    op: BinaryOp::LessOrEqual,
+                    ..
+                },
+                ..
+            })
+        ));
+    }
+    for word in ["oa_analysis", "sa_analysis"] {
+        let Body::Case { subject, base, overrides } = declaration(&format!("{word} degraded \"Degraded radio\" {{ subject @respond; base ModelBaseline; overrides {{ @receive_time = unbound; }}; }}")).body else { panic!("case") };
+        assert_eq!(subject.unwrap().value.unwrap().name, "respond");
+        assert!(base.value_span.end > base.value_span.start);
+        assert_eq!(overrides.value.len(), 1);
+        assert_eq!(overrides.value[0].target.name, "receive_time");
+        assert!(matches!(overrides.value[0].binding, Binding::Unbound(_)));
+    }
+}
+
+#[test]
+fn empty_unbound_and_all_scalar_list_types_are_explicit_valid_syntax() {
+    for (spelling, list, kind) in [
+        ("Boolean", false, 0),
+        ("Number", false, 1),
+        ("Quantity(@duration)", false, 2),
+        ("List(Boolean)", true, 0),
+        ("List(Number)", true, 1),
+        ("List(Quantity(@duration))", true, 2),
+    ] {
+        let Body::Calculation {
+            parameters,
+            result,
+            body,
+        } = declaration(&format!(
+            "calculation c \"C\" {{ result {spelling}; body unbound; }}"
+        ))
+        .body
+        else {
+            panic!()
+        };
+        assert!(parameters.is_empty());
+        assert_eq!(result.value.list, list);
+        assert_eq!(
+            match result.value.scalar.kind {
+                ScalarKind::Boolean => 0,
+                ScalarKind::Number => 1,
+                ScalarKind::Quantity(_) => 2,
+            },
+            kind
+        );
+        assert!(matches!(body.value, Binding::Unbound(_)));
+    }
+    let Body::QuantityKind { dimension, algebra } =
+        declaration("quantity_kind q \"Q\" { dimension {}; algebra Linear; }").body
+    else {
+        panic!()
+    };
+    assert_eq!(dimension.value.exponents, [0; 7]);
+    assert!(dimension.value.entries.is_empty());
+    assert_eq!(algebra.value, AlgebraSyntax::Linear);
+    let Body::Case {
+        subject, overrides, ..
+    } = declaration("oa_analysis c \"C\" { base ModelBaseline; overrides {}; }").body
+    else {
+        panic!()
+    };
+    assert!(subject.is_none());
+    assert!(overrides.value.is_empty());
+    let Body::Check {
+        subject,
+        documented_constraint,
+        ..
+    } = declaration("oa_check c \"C\" { predicate unbound; }").body
+    else {
+        panic!()
+    };
+    assert!(subject.is_none() && documented_constraint.is_none());
+    let Body::Property { display_unit, .. } =
+        declaration("oa_property p \"P\" { subject @s; type Number; base unbound; }").body
+    else {
+        panic!()
+    };
+    assert!(display_unit.is_none());
+}
+
+#[test]
+fn missing_required_fields_and_unknown_or_duplicate_entries_reject_locally() {
+    let required_sets: &[(&str, &[&str])] = &[
+        (
+            "quantity_kind q \"Q\"",
+            &["dimension {};", "algebra Linear;"],
+        ),
+        (
+            "unit u \"U\"",
+            &["kind @q;", "scale 1;", "offset 0;", "symbol \"u\";"],
+        ),
+        ("calculation c \"C\"", &["result Number;", "body unbound;"]),
+        (
+            "oa_property p \"P\"",
+            &["subject @s;", "type Number;", "base unbound;"],
+        ),
+        ("oa_check c \"C\"", &["predicate unbound;"]),
+        (
+            "oa_analysis a \"A\"",
+            &["base ModelBaseline;", "overrides {};"],
+        ),
+    ];
+    for (header, fields) in required_sets {
+        declaration(&format!("{header} {{ {} }}", fields.join(" ")));
+        for removed in 0..fields.len() {
+            let remaining = fields
+                .iter()
+                .enumerate()
+                .filter_map(|(i, field)| (i != removed).then_some(*field))
+                .collect::<Vec<_>>()
+                .join(" ");
+            let error = failure(&format!("{header} {{ {remaining} }}"));
+            assert!(
+                error.message.contains("Missing required field"),
+                "{error:?}"
+            );
+            let duplicate = format!("{header} {{ {} {} }}", fields.join(" "), fields[removed]);
+            assert!(failure(&duplicate).message.contains("Duplicate field"));
+        }
+    }
+    for source in [
+        "quantity_kind q \"Q\" { dimension { time 1; time 2; }; algebra Linear; }",
+        "quantity_kind q \"Q\" { dimension { unknown 1; }; algebra Linear; }",
+        "quantity_kind q \"Q\" { dimension { time 33; }; algebra Linear; }",
+        "unit u \"U\" { kind @q; scale 1 + 2; offset 0; symbol \"u\"; }",
+        "unit u \"U\" { kind @q; scale 1 [@u]; offset 0; symbol \"u\"; }",
+        "unit u \"U\" { kind @q; scale ratio(1, 0); offset 0; symbol \"u\"; }",
+        "calculation c \"C\" { result List(List(Number)); body unbound; }",
+        "calculation c \"C\" { input x : Number; input x : Number; result Number; body unbound; }",
+        "calculation c \"C\" { input x id \"28ff40b0-1b8f-4735-8536-5a6ab21b56cb\" : Number; input y id \"28ff40b0-1b8f-4735-8536-5a6ab21b56cb\" : Number; result Number; body unbound; }",
+        "oa_property p \"P\" { subject none; type Number; base unbound; }",
+        "oa_property p \"P\" { subject @s; type Number; base none; }",
+        "oa_property p \"P\" { subject @s; type Number; base unbound; parent @s; }",
+        "oa_analysis a \"A\" { base @another; overrides {}; }",
+        "oa_analysis a \"A\" { base ModelBaseline; overrides { @p = clear; }; }",
+        "oa_analysis a \"A\" { base ModelBaseline; overrides { @p = 1; @p = 2; }; }",
+        "oa_check c \"C\" { predicate @f(x: 1, x: 2); }",
+        "quantity_kind q \"Q\" { dimension {}; algebra Linear; parent none; }",
+        "oa_check c \"C\" { predicate unbound; invented none; }",
+    ] {
+        failure(source);
+    }
+    let duplicate = "oa_analysis a \"A\" { base ModelBaseline; overrides { @p = 1; @p = 2; }; }";
+    let error = failure(duplicate);
+    assert_eq!(text(duplicate, error.span), "p");
+    assert!(error.span.start > duplicate.find("@p").unwrap() + 1);
+}
+
+#[test]
+fn borrowed_cursor_preserves_full_file_spans_and_does_not_rescan_fields() {
+    let source = "// 雪\r\ncalculation c \"C\" { input a : Number; result Number; body @combine(a: ratio (1, // first\r\n 2), b: $a) + @combine(a: 2, b: $a); }\r\nunit u \"U\" { kind @q; scale 1; offset 0; symbol \"u\"; }";
+    let mut shared = budget();
+    let tokens = lex::tokens(source, &mut shared).unwrap();
+    let lexical = shared.usage;
+    let mut cursor = Cursor::new(source, &tokens, &mut shared);
+    let first = parse(&mut cursor, 8, None).unwrap();
+    assert_eq!(cursor.text(), "unit");
+    let first_end = first.span.end;
+    let second = parse(&mut cursor, 8, None).unwrap();
+    cursor.end().unwrap();
+    assert!(second.span.start > first_end);
+    assert_eq!(text(source, first.header.kind_span), "calculation");
+    assert_eq!(text(source, first.header.name_span), "\"C\"");
+    assert_eq!(text(source, second.header.alias.span), "u");
+    assert_eq!(
+        text(source, first.body_span).trim().strip_prefix("input"),
+        Some(
+            " a : Number; result Number; body @combine(a: ratio (1, // first\r\n 2), b: $a) + @combine(a: 2, b: $a);"
+        )
+    );
+    let Body::Calculation {
+        parameters, body, ..
+    } = first.body
+    else {
+        panic!()
+    };
+    assert_eq!(text(source, parameters[0].span), "input a : Number;");
+    assert_eq!(text(source, parameters[0].value_type.span), "Number");
+    let Binding::Expression(Expression {
+        kind: ExpressionKind::Binary { left, right, .. },
+        ..
+    }) = body.value
+    else {
+        panic!()
+    };
+    let ExpressionKind::Call {
+        arguments: left, ..
+    } = left.kind
+    else {
+        panic!()
+    };
+    let ExpressionKind::Call {
+        arguments: right, ..
+    } = right.kind
+    else {
+        panic!()
+    };
+    let spans = [
+        left[0].parameter.span,
+        left[1].parameter.span,
+        right[0].parameter.span,
+        right[1].parameter.span,
+    ];
+    assert_eq!(spans.map(|span| text(source, span)), ["a", "b", "a", "b"]);
+    assert!(spans.windows(2).all(|pair| pair[0].end < pair[1].start));
+    let literal = left[0].value.literal.as_ref().unwrap();
+    assert_eq!(text(source, literal.span), "ratio (1, // first\r\n 2)");
+    assert_eq!(
+        literal
+            .tokens
+            .iter()
+            .map(|span| text(source, *span))
+            .collect::<Vec<_>>(),
+        ["ratio", "(", "1", ",", "2", ")"]
+    );
+    assert_eq!(shared.usage.bytes, source.len());
+    assert_eq!(shared.usage.bytes, lexical.bytes);
+    assert_eq!(shared.usage.tokens, lexical.tokens);
+    assert_eq!(shared.usage.references, 9); // two calls, four keys, two $a, unit kind.
+}
+
+#[test]
+fn missing_id_metadata_is_stable_and_parameter_ids_are_owner_scoped() {
+    let source =
+        "calculation c \"C\" { input a // identity here\r\n : Number; result Number; body $a; }";
+    let first = declaration(source);
+    let second = declaration(source);
+    assert_eq!(first, second);
+    assert_eq!(
+        first.header.identity.insertion,
+        Some(source.find('{').unwrap())
+    );
+    let Body::Calculation { parameters, .. } = first.body else {
+        panic!()
+    };
+    let id = &parameters[0].identity;
+    assert!(id.value.is_none() && id.literal.is_none() && id.keyword.is_none());
+    assert_eq!(id.insertion, Some(source.find(':').unwrap()));
+    let explicit = "28ff40b0-1b8f-4735-8536-5a6ab21b56cb";
+    // Syntax does not add ParameterIds to a global identity registry, and an
+    // explicit parameter ID can equal its own calculation's global UUID.
+    for name in ["one", "two"] {
+        let source = format!(
+            "calculation {name} \"C\" id \"{explicit}\" {{ input a id \"{explicit}\" : Number; result Number; body $a; }}"
+        );
+        let actual = declaration(&source);
+        let Body::Calculation { parameters, .. } = actual.body else {
+            panic!()
+        };
+        assert_eq!(parameters[0].identity.value, actual.header.identity.value);
+        assert!(parameters[0].identity.insertion.is_none());
+    }
+}
+
+#[test]
+fn inherited_version_root_and_short_word_contracts_do_not_enable_public8() {
+    let source = "oa_check c \"C\" { predicate unbound; }";
+    for version in [1, 2, 3, 4, 5, 6, 7, 9] {
+        let mut budget = budget();
+        let tokens = lex::tokens(source, &mut budget).unwrap();
+        let error = parse(
+            &mut Cursor::new(source, &tokens, &mut budget),
+            version,
+            None,
+        )
+        .unwrap_err();
+        assert_eq!(text(source, error.span), "oa_check");
+        assert!(error.message.contains("source8"));
+    }
+    let mut budget = budget();
+    let tokens = lex::tokens(source, &mut budget).unwrap();
+    assert!(
+        parse(
+            &mut Cursor::new(source, &tokens, &mut budget),
+            8,
+            Some(Id::nil())
+        )
+        .unwrap_err()
+        .message
+        .contains("roots")
+    );
+    for word in [
+        "oa_engineering_property",
+        "sa_engineering_property",
+        "oa_analysis_check",
+        "sa_analysis_check",
+        "oa_analysis_case",
+        "sa_analysis_case",
+    ] {
+        assert!(declaration_kind(word).is_none());
+    }
+    for alias in [
+        "unit",
+        "calculation",
+        "quantity_kind",
+        "oa_property",
+        "if",
+        "and",
+        "List",
+    ] {
+        let old = format!("arcadia 7; project {alias} \"P\" {{}}");
+        assert!(crate::language::parse(&old).is_ok(), "{old}");
+    }
+    let contextual =
+        declaration("calculation unit \"C\" { input and : Number; result Number; body $and; }");
+    assert_eq!(contextual.header.alias.name, "unit");
+    assert!(crate::language::parse("arcadia 8; project p \"P\" {}").is_err());
+    for version in 3..=7 {
+        assert!(
+            crate::language::parse(&format!(
+                "arcadia {version}; project p \"P\" {{ {source} }}"
+            ))
+            .is_err()
+        );
+    }
+}
+
+#[test]
+fn declaration_budgets_share_literals_types_references_and_failure_state() {
+    let source = "unit u \"U\" { kind @q; scale ratio(1, 3); offset ratio(2, 7); symbol \"u\"; }";
+    let mut measured = budget();
+    let tokens = lex::tokens(source, &mut measured).unwrap();
+    parse(&mut Cursor::new(source, &tokens, &mut measured), 8, None).unwrap();
+    let numeric = measured.numeric_units();
+    assert!(numeric > 0);
+    // All declaration, field and type entries share the same preallocation
+    // ceiling. Measure a deterministic valid counterpart before reducing it.
+    for (maximum, succeeds) in [
+        (measured.usage.entries, true),
+        (measured.usage.entries - 1, false),
+    ] {
+        let mut profile = limits();
+        profile.entries = maximum;
+        let mut shared = Budget::new(profile).unwrap();
+        let tokens = lex::tokens(source, &mut shared).unwrap();
+        let result = parse(&mut Cursor::new(source, &tokens, &mut shared), 8, None);
+        assert_eq!(result.is_ok(), succeeds);
+        if !succeeds {
+            assert!(result.unwrap_err().message.contains("entries"));
+        }
+    }
+    for (maximum, succeeds) in [(numeric, true), (numeric - 1, false)] {
+        let mut profile = limits();
+        profile.numeric_units = maximum;
+        let mut shared = Budget::new(profile).unwrap();
+        let tokens = lex::tokens(source, &mut shared).unwrap();
+        let result = parse(&mut Cursor::new(source, &tokens, &mut shared), 8, None);
+        assert_eq!(result.is_ok(), succeeds);
+    }
+    let first =
+        "calculation c \"C\" { input x : Quantity(@q); result Quantity(@q); body unbound; }";
+    let second = "oa_property p \"P\" { subject @s; type Quantity(@q); base 1 [@u]; }";
+    let mut profile = limits();
+    profile.references = 4;
+    let mut shared = Budget::new(profile).unwrap();
+    let tokens = lex::tokens(first, &mut shared).unwrap();
+    parse(&mut Cursor::new(first, &tokens, &mut shared), 8, None).unwrap();
+    assert_eq!(shared.usage.references, 2);
+    let tokens = lex::tokens(second, &mut shared).unwrap();
+    let error = parse(&mut Cursor::new(second, &tokens, &mut shared), 8, None).unwrap_err();
+    assert_eq!(text(second, error.span), "u");
+    assert_eq!(shared.usage.references, 4);
+    assert_eq!(shared.active().unwrap_err(), error);
+    let numeric_after_failure = shared.numeric_units();
+    assert!(lex::tokens("1", &mut shared).is_err());
+    assert_eq!(shared.numeric_units(), numeric_after_failure);
+    let unbound_tokens = lex::tokens("unbound", &mut budget()).unwrap();
+    assert_eq!(
+        syntax::binding(&mut Cursor::new("unbound", &unbound_tokens, &mut shared)).unwrap_err(),
+        error
+    );
+    assert!(
+        declaration("oa_check fresh \"Fresh\" { predicate true; }")
+            .parent
+            .is_none()
+    );
+}
+
+#[test]
+fn typed_frame_budget_and_truncated_declaration_cleanup_have_nearby_successes() {
+    let source = "calculation c \"C\" { result List(Quantity(@q)); body unbound; }";
+    for (maximum, succeeds) in [(3, true), (2, false)] {
+        let mut profile = limits();
+        profile.frames = maximum;
+        let mut shared = Budget::new(profile).unwrap();
+        let tokens = lex::tokens(source, &mut shared).unwrap();
+        assert_eq!(
+            parse(&mut Cursor::new(source, &tokens, &mut shared), 8, None).is_ok(),
+            succeeds
+        );
+    }
+    let source = "oa_analysis a \"A\" { base ModelBaseline; overrides { @p = if(true, ratio(1, 2), @f(a: 1)); }; }";
+    let tokens = lex::tokens(source, &mut budget()).unwrap();
+    for token in tokens
+        .iter()
+        .filter(|token| matches!(text(source, token.span), "{" | "(" | "," | ":" | "="))
+    {
+        let prefix = &source[..token.span.end];
+        let mut shared = budget();
+        let tokens = lex::tokens(prefix, &mut shared).unwrap();
+        assert!(parse(&mut Cursor::new(prefix, &tokens, &mut shared), 8, None).is_err());
+        declaration("oa_check fresh \"Fresh\" { predicate true; }");
+    }
+}
+
+#[test]
+fn typed_brace_frames_have_exact_zero_one_two_boundaries() {
+    let mut profile = limits();
+    profile.frames = 0;
+    let mut shared = Budget::new(profile).unwrap();
+    let tokens = lex::tokens("unbound", &mut shared).unwrap();
+    let mut cursor = Cursor::new("unbound", &tokens, &mut shared);
+    assert!(matches!(
+        syntax::binding(&mut cursor).unwrap(),
+        Binding::Unbound(_)
+    ));
+    assert_eq!(cursor.frames, 0);
+    assert_eq!(shared.usage.deepest_frame, 0);
+
+    for (source, needed) in [
+        ("calculation c \"C\" { result Number; body unbound; }", 1),
+        ("quantity_kind q \"Q\" { dimension {}; algebra Linear; }", 2),
+        (
+            "oa_analysis a \"A\" { base ModelBaseline; overrides {}; }",
+            2,
+        ),
+    ] {
+        for maximum in 0..=2 {
+            let mut profile = limits();
+            profile.frames = maximum;
+            let mut shared = Budget::new(profile).unwrap();
+            let tokens = lex::tokens(source, &mut shared).unwrap();
+            let mut cursor = Cursor::new(source, &tokens, &mut shared);
+            let result = parse(&mut cursor, 8, None);
+            assert_eq!(
+                result.is_ok(),
+                maximum >= needed,
+                "{source}, limit {maximum}"
+            );
+            if let Err(error) = result {
+                assert!(error.message.contains("frames"));
+                assert_eq!(text(source, error.span), "{");
+                assert_eq!(
+                    error.span.start,
+                    if maximum == 0 {
+                        source.find('{').unwrap()
+                    } else {
+                        source.rfind('{').unwrap()
+                    }
+                );
+            } else {
+                assert_eq!(cursor.frames, 0);
+                cursor.end().unwrap();
+                assert_eq!(shared.usage.deepest_frame, needed);
+            }
+        }
+    }
+}
+
+#[test]
+fn declaration_frames_restore_the_callers_inherited_context() {
+    let source = "calculation a \"A\" { result Number; body unbound; } calculation b \"B\" { result Number; body unbound; }";
+    for maximum in [1, 2] {
+        let mut profile = limits();
+        profile.frames = maximum;
+        let mut shared = Budget::new(profile).unwrap();
+        let tokens = lex::tokens(source, &mut shared).unwrap();
+        let mut cursor = Cursor::new(source, &tokens, &mut shared);
+        // Future project/include integration owns this outer context. The
+        // declaration consumer must add to it, then restore it after closing.
+        cursor.frames = 1;
+        let first = parse(&mut cursor, 8, None);
+        if maximum == 1 {
+            let error = first.unwrap_err();
+            assert!(error.message.contains("frames"));
+            assert_eq!(text(source, error.span), "{");
+        } else {
+            assert!(first.is_ok());
+            assert_eq!(cursor.frames, 1);
+            parse(&mut cursor, 8, None).unwrap();
+            assert_eq!(cursor.frames, 1);
+            cursor.end().unwrap();
+            assert_eq!(shared.usage.deepest_frame, 2);
+        }
+    }
+}

crates/oa-core/src/language/analysis_source/lex.rs

@@ -0,0 +1,52 @@
+//! Source8 significant-token adapter over the shared raw scanner.
+use super::super::raw_tokens::{Class as RawClass, Scanner};
+use super::{Budget, Error, Span, error};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Class {
+    Word,
+    Number,
+    String,
+    Punctuation,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Token {
+    pub class: Class,
+    pub span: Span,
+}
+
+pub fn tokens(source: &str, budget: &mut Budget) -> Result<Vec<Token>, Error> {
+    budget.bytes(
+        source.len(),
+        Span {
+            start: 0,
+            end: source.len(),
+        },
+    )?;
+    let mut scanner = Scanner::new(source);
+    let mut result = Vec::new();
+    let mut offset = 0;
+    while offset < source.len() {
+        // Charge trivia too, before the scanner advances or a token is stored.
+        budget.token(Span {
+            start: offset,
+            end: offset,
+        })?;
+        let token = scanner.next().expect("source remains");
+        offset = token.span.end;
+        let class = match token.class {
+            RawClass::Word => Class::Word,
+            RawClass::Number => Class::Number,
+            RawClass::String => Class::String,
+            RawClass::Punctuation => Class::Punctuation,
+            RawClass::Whitespace | RawClass::Comment => continue,
+            RawClass::Error => return Err(error(token.span, "Invalid source token.")),
+        };
+        result.push(Token {
+            class,
+            span: token.span,
+        });
+    }
+    Ok(result)
+}

crates/oa-core/src/language/analysis_source/lower.rs

@@ -0,0 +1,939 @@
+//! Staged typed resolution. The caller owns parsing, ID stabilization and the
+//! single complete-Project semantic admission after merging these additions.
+use super::declarations::{self as d, Declaration, DeclarationKind};
+use super::*;
+use crate::analysis as a;
+use crate::analysis_numeric::Dimension;
+use crate::{Element, ElementBody, Id, Kind, Layer, Project, SharedBody};
+use std::collections::{BTreeMap, BTreeSet};
+
+/// Caller-assigned file key; spans are original offsets within that file.
+pub(super) struct Unit {
+    pub file: usize,
+    pub declarations: Vec<Declaration>,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Failure {
+    /// None denotes an invalid ordinary skeleton, before typed resolution.
+    pub file: Option<usize>,
+    pub error: Error,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Category {
+    Project,
+    Element(Kind, Layer),
+    Relation,
+    Diagram,
+    Node,
+    Artifact,
+    Trace,
+    QuantityKind,
+    Unit,
+    Calculation,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Target {
+    Global(Id),
+    Parameter {
+        calculation: Id,
+        parameter: a::ParameterId,
+    },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Field {
+    Algebra,
+    Kind,
+    Input(a::ParameterId),
+    Result,
+    Body,
+    Subject,
+    Type,
+    Base,
+    DisplayUnit,
+    DocumentedConstraint,
+    Predicate,
+    Override(Id),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Role {
+    Reference,
+    ParameterDeclaration,
+    ParameterUse,
+    CallTarget,
+    ArgumentLabel,
+    OverrideTarget,
+}
+
+/// Stable structural edges, independent of alias spelling and argument order.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Child {
+    Item(usize),
+    Operand,
+    Left,
+    Right,
+    Condition,
+    WhenTrue,
+    WhenFalse,
+    Argument(a::ParameterId),
+    Values,
+    Initial,
+    Base,
+    Value,
+}
+
+/// An arena index is only local to this lowering result. Follow parent edges
+/// to obtain the owner/field/path identity for S3; never persist the index.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct ExpressionSite {
+    pub file: usize,
+    pub owner: Id,
+    pub field: Field,
+    pub parent: Option<(usize, Child)>,
+    pub span: Span,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Occurrence {
+    pub file: usize,
+    pub owner: Id,
+    pub field: Field,
+    pub expression: Option<usize>,
+    pub role: Role,
+    pub target: Target,
+    /// Alias/name token only, excluding @/$ and surrounding trivia.
+    pub span: Span,
+}
+
+#[derive(Debug)]
+pub(super) struct Lowered {
+    pub definitions: BTreeMap<Id, a::Definition>,
+    pub elements: BTreeMap<Id, Element>,
+    pub occurrences: Vec<Occurrence>,
+    pub expressions: Vec<ExpressionSite>,
+}
+
+#[derive(Clone, Copy)]
+struct Symbol {
+    id: Id,
+    category: Category,
+}
+
+#[derive(Default)]
+struct Tables {
+    aliases: BTreeMap<String, Symbol>,
+    ids: BTreeSet<Id>,
+    parameters: BTreeMap<Id, BTreeMap<String, a::ParameterId>>,
+    entries: usize,
+}
+
+fn category(kind: DeclarationKind) -> Category {
+    match kind {
+        DeclarationKind::QuantityKind => Category::QuantityKind,
+        DeclarationKind::Unit => Category::Unit,
+        DeclarationKind::Calculation => Category::Calculation,
+        DeclarationKind::Property(layer) => Category::Element(Kind::EngineeringProperty, layer),
+        DeclarationKind::Check(layer) => Category::Element(Kind::AnalysisCheck, layer),
+        DeclarationKind::Case(layer) => Category::Element(Kind::AnalysisCase, layer),
+    }
+}
+
+fn identity(identity: &d::IdentitySyntax, span: Span) -> Result<Id, Error> {
+    identity.value.ok_or_else(|| {
+        error(
+            span,
+            "Missing ID requires source stabilization before lowering.",
+        )
+    })
+}
+
+impl Tables {
+    fn reserve(&mut self, span: Span, budget: &Budget) -> Result<(), Error> {
+        budget.lowering_entries(self.entries + 1, span)?;
+        self.entries += 1;
+        Ok(())
+    }
+    fn insert(
+        &mut self,
+        id: Id,
+        alias: &str,
+        category: Category,
+        span: Span,
+        budget: &Budget,
+    ) -> Result<(), Error> {
+        // A phase allocation bound, not a second syntax charge. Ordinary
+        // records, typed headers and scoped parameters share this bound.
+        self.reserve(span, budget)?;
+        if self.ids.contains(&id) {
+            return Err(error(span, "Duplicate global identity."));
+        }
+        if self.aliases.contains_key(alias) {
+            return Err(error(span, format!("Duplicate global alias '{alias}'.")));
+        }
+        self.ids.insert(id);
+        self.aliases
+            .insert(alias.to_owned(), Symbol { id, category });
+        Ok(())
+    }
+
+    fn ordinary(&mut self, project: &Project, budget: &Budget) -> Result<(), Error> {
+        let at = Span::default();
+        self.insert(project.id, &project.alias, Category::Project, at, budget)?;
+        for value in project.definitions.values() {
+            let category = match &value.body {
+                a::DefinitionBody::QuantityKind(_) => Category::QuantityKind,
+                a::DefinitionBody::Unit(_) => Category::Unit,
+                a::DefinitionBody::Calculation(_) => Category::Calculation,
+            };
+            self.insert(value.id, &value.alias, category, at, budget)?;
+            if let a::DefinitionBody::Calculation(calculation) = &value.body {
+                let mut names = BTreeMap::new();
+                let mut ids = BTreeSet::new();
+                for parameter in &calculation.parameters {
+                    self.reserve(at, budget)?;
+                    if names.contains_key(&parameter.name) || !ids.insert(parameter.id) {
+                        return Err(error(
+                            at,
+                            "Duplicate parameter name or identity in ordinary catalog.",
+                        ));
+                    }
+                    names.insert(parameter.name.clone(), parameter.id);
+                }
+                self.parameters.insert(value.id, names);
+            }
+        }
+        for value in project.elements.values() {
+            self.insert(
+                value.id,
+                &value.alias,
+                Category::Element(value.kind(), value.layer()),
+                at,
+                budget,
+            )?;
+        }
+        for value in project.relations.values() {
+            self.insert(value.id, &value.alias, Category::Relation, at, budget)?;
+        }
+        for value in project.diagrams.values() {
+            self.insert(value.id, &value.alias, Category::Diagram, at, budget)?;
+            for node in value.nodes.values() {
+                self.insert(node.id, &node.alias, Category::Node, at, budget)?;
+            }
+        }
+        for value in project.artifact_links.values() {
+            self.insert(value.id, &value.alias, Category::Artifact, at, budget)?;
+        }
+        for value in project.traces.values() {
+            self.insert(value.id, &value.alias, Category::Trace, at, budget)?;
+        }
+        Ok(())
+    }
+
+    fn typed(&mut self, declaration: &Declaration, budget: &Budget) -> Result<(), Error> {
+        let header = &declaration.header;
+        let id = identity(&header.identity, header.alias.span)?;
+        self.insert(
+            id,
+            &header.alias.name,
+            category(header.kind),
+            header.alias.span,
+            budget,
+        )?;
+        if let d::Body::Calculation { parameters, .. } = &declaration.body {
+            let mut names = BTreeMap::new();
+            let mut ids = BTreeSet::new();
+            for parameter in parameters {
+                self.reserve(parameter.span, budget)?;
+                let id = a::ParameterId(identity(&parameter.identity, parameter.name.span)?);
+                if names.contains_key(&parameter.name.name) || !ids.insert(id) {
+                    return Err(error(
+                        parameter.name.span,
+                        "Duplicate parameter name or identity.",
+                    ));
+                }
+                names.insert(parameter.name.name.clone(), id);
+            }
+            self.parameters.insert(id, names);
+        }
+        Ok(())
+    }
+}
+
+/// Inputs must come from the same live Budget and stabilization pass. No scan,
+/// exact conversion or reference charge occurs here. The ordinary skeleton is
+/// not semantically admitted: its typed forward references may need additions.
+pub(super) fn lower(
+    ordinary: &Project,
+    units: &[Unit],
+    budget: &Budget,
+) -> Result<Lowered, Failure> {
+    budget
+        .active()
+        .map_err(|error| Failure { file: None, error })?;
+    let mut tables = Tables::default();
+    tables
+        .ordinary(ordinary, budget)
+        .map_err(|error| Failure { file: None, error })?;
+    let mut files = BTreeSet::new();
+    for unit in units {
+        budget
+            .lowering_entries(files.len() + 1, Span::default())
+            .map_err(|error| Failure {
+                file: Some(unit.file),
+                error,
+            })?;
+        if !files.insert(unit.file) {
+            return Err(Failure {
+                file: Some(unit.file),
+                error: error(Span::default(), "Duplicate source file key."),
+            });
+        }
+        for declaration in &unit.declarations {
+            tables.typed(declaration, budget).map_err(|error| Failure {
+                file: Some(unit.file),
+                error,
+            })?;
+        }
+    }
+    let mut output = Lowered {
+        definitions: BTreeMap::new(),
+        elements: BTreeMap::new(),
+        occurrences: Vec::new(),
+        expressions: Vec::new(),
+    };
+    for unit in units {
+        for declaration in &unit.declarations {
+            let owner = declaration
+                .header
+                .identity
+                .value
+                .expect("collected stable identity");
+            let mut resolver = Resolver {
+                tables: &tables,
+                output: &mut output,
+                budget,
+                file: unit.file,
+                owner,
+            };
+            resolver.declaration(declaration).map_err(|error| Failure {
+                file: Some(unit.file),
+                error,
+            })?;
+        }
+    }
+    Ok(output)
+}
+
+struct Resolver<'a> {
+    tables: &'a Tables,
+    output: &'a mut Lowered,
+    budget: &'a Budget,
+    file: usize,
+    owner: Id,
+}
+
+impl Resolver<'_> {
+    fn occurrence(
+        &mut self,
+        reference: &Reference,
+        field: Field,
+        expression: Option<usize>,
+        role: Role,
+        target: Target,
+    ) -> Result<(), Error> {
+        self.budget
+            .lowering_occurrences(self.output.occurrences.len() + 1, reference.span)?;
+        self.output.occurrences.push(Occurrence {
+            file: self.file,
+            owner: self.owner,
+            field,
+            expression,
+            role,
+            target,
+            span: reference.span,
+        });
+        Ok(())
+    }
+
+    fn global(
+        &mut self,
+        reference: &Reference,
+        field: Field,
+        expression: Option<usize>,
+        role: Role,
+        expected: impl FnOnce(Category) -> bool,
+    ) -> Result<Symbol, Error> {
+        let symbol = *self.tables.aliases.get(&reference.name).ok_or_else(|| {
+            error(
+                reference.span,
+                format!("Unknown global reference '@{}'.", reference.name),
+            )
+        })?;
+        if !expected(symbol.category) {
+            return Err(error(
+                reference.span,
+                format!(
+                    "Wrong reference domain for '@{}': {:?}.",
+                    reference.name, symbol.category
+                ),
+            ));
+        }
+        self.occurrence(
+            reference,
+            field,
+            expression,
+            role,
+            Target::Global(symbol.id),
+        )?;
+        Ok(symbol)
+    }
+
+    fn definition_ref(
+        &mut self,
+        reference: &Reference,
+        field: Field,
+        expression: Option<usize>,
+        expected: Category,
+    ) -> Result<a::DefinitionRef, Error> {
+        self.global(reference, field, expression, Role::Reference, |category| {
+            category == expected
+        })
+        .map(|symbol| a::DefinitionRef::Local(symbol.id))
+    }
+
+    fn value_type(
+        &mut self,
+        value: &d::TypeSyntax,
+        field: Field,
+    ) -> Result<a::AnalysisType, Error> {
+        let scalar =
+            match &value.scalar.kind {
+                d::ScalarKind::Boolean => a::ScalarType::Boolean,
+                d::ScalarKind::Number => a::ScalarType::Number,
+                d::ScalarKind::Quantity(reference) => a::ScalarType::Quantity(
+                    self.definition_ref(reference, field, None, Category::QuantityKind)?,
+                ),
+            };
+        Ok(if value.list {
+            a::AnalysisType::List(scalar)
+        } else {
+            a::AnalysisType::Scalar(scalar)
+        })
+    }
+
+    fn subject(&mut self, reference: &Reference) -> Result<a::AnalysisSubject, Error> {
+        let symbol = self.global(
+            reference,
+            Field::Subject,
+            None,
+            Role::Reference,
+            |category| matches!(category, Category::Element(..) | Category::Relation),
+        )?;
+        Ok(if symbol.category == Category::Relation {
+            a::AnalysisSubject::Relation(symbol.id)
+        } else {
+            a::AnalysisSubject::Element(symbol.id)
+        })
+    }
+
+    fn optional_subject(
+        &mut self,
+        subject: &Option<d::Field<Option<Reference>>>,
+    ) -> Result<Option<a::AnalysisSubject>, Error> {
+        subject
+            .as_ref()
+            .and_then(|field| field.value.as_ref())
+            .map(|reference| self.subject(reference))
+            .transpose()
+    }
+
+    fn declaration(&mut self, declaration: &Declaration) -> Result<(), Error> {
+        let header = &declaration.header;
+        let definition = match &declaration.body {
+            d::Body::QuantityKind { dimension, algebra } => {
+                Some(a::DefinitionBody::QuantityKind(a::QuantityKindDefinition {
+                    dimension: Dimension::new(dimension.value.exponents)
+                        .map_err(|cause| error(dimension.value_span, cause.to_string()))?,
+                    algebra: match &algebra.value {
+                        d::AlgebraSyntax::Linear => a::QuantityAlgebra::Linear,
+                        d::AlgebraSyntax::Affine(reference) => a::QuantityAlgebra::Affine {
+                            difference: self.definition_ref(
+                                reference,
+                                Field::Algebra,
+                                None,
+                                Category::QuantityKind,
+                            )?,
+                        },
+                    },
+                }))
+            }
+            d::Body::Unit {
+                kind,
+                scale,
+                offset,
+                symbol,
+            } => Some(a::DefinitionBody::Unit(a::UnitDefinition {
+                kind: self.definition_ref(
+                    &kind.value,
+                    Field::Kind,
+                    None,
+                    Category::QuantityKind,
+                )?,
+                scale: scale.value.value.clone(),
+                offset: offset.value.value.clone(),
+                symbol: symbol.value.clone(),
+            })),
+            d::Body::Calculation {
+                parameters,
+                result,
+                body,
+            } => {
+                let mut lowered = Vec::new();
+                for parameter in parameters {
+                    self.budget
+                        .lowering_entries(lowered.len() + 1, parameter.span)?;
+                    let id = self.tables.parameters[&self.owner][&parameter.name.name];
+                    self.occurrence(
+                        &parameter.name,
+                        Field::Input(id),
+                        None,
+                        Role::ParameterDeclaration,
+                        Target::Parameter {
+                            calculation: self.owner,
+                            parameter: id,
+                        },
+                    )?;
+                    lowered.push(a::Parameter {
+                        id,
+                        name: parameter.name.name.clone(),
+                        value_type: self.value_type(&parameter.value_type, Field::Input(id))?,
+                    });
+                }
+                Some(a::DefinitionBody::Calculation(a::CalculationDefinition {
+                    parameters: lowered,
+                    result: self.value_type(&result.value, Field::Result)?,
+                    body: self.binding(&body.value, Field::Body, Some(self.owner))?,
+                }))
+            }
+            _ => None,
+        };
+        let description = declaration
+            .description
+            .as_ref()
+            .map_or_else(String::new, |field| field.value.clone());
+        if let Some(body) = definition {
+            self.output.definitions.insert(
+                self.owner,
+                a::Definition {
+                    id: self.owner,
+                    alias: header.alias.name.clone(),
+                    name: header.name.clone(),
+                    description,
+                    body,
+                },
+            );
+            return Ok(());
+        }
+        let (layer, body) = match (&declaration.body, header.kind) {
+            (
+                d::Body::Property {
+                    subject,
+                    value_type,
+                    base,
+                    display_unit,
+                },
+                DeclarationKind::Property(layer),
+            ) => (
+                layer,
+                SharedBody::EngineeringProperty {
+                    subject: self.subject(&subject.value)?,
+                    value_type: self.value_type(&value_type.value, Field::Type)?,
+                    base: self.binding(&base.value, Field::Base, None)?,
+                    display_unit: display_unit
+                        .as_ref()
+                        .and_then(|field| field.value.as_ref())
+                        .map(|reference| {
+                            self.definition_ref(reference, Field::DisplayUnit, None, Category::Unit)
+                        })
+                        .transpose()?,
+                },
+            ),
+            (
+                d::Body::Check {
+                    subject,
+                    documented_constraint,
+                    predicate,
+                },
+                DeclarationKind::Check(layer),
+            ) => (
+                layer,
+                SharedBody::AnalysisCheck {
+                    subject: self.optional_subject(subject)?,
+                    documented_constraint: documented_constraint
+                        .as_ref()
+                        .and_then(|field| field.value.as_ref())
+                        .map(|reference| {
+                            self.global(
+                                reference,
+                                Field::DocumentedConstraint,
+                                None,
+                                Role::Reference,
+                                |category| {
+                                    matches!(category, Category::Element(Kind::Constraint, _))
+                                },
+                            )
+                            .map(|symbol| symbol.id)
+                        })
+                        .transpose()?,
+                    predicate: self.binding(&predicate.value, Field::Predicate, None)?,
+                },
+            ),
+            (
+                d::Body::Case {
+                    subject, overrides, ..
+                },
+                DeclarationKind::Case(layer),
+            ) => {
+                let subject = self.optional_subject(subject)?;
+                let mut lowered = BTreeMap::new();
+                for entry in &overrides.value {
+                    let property = self
+                        .global(
+                            &entry.target,
+                            Field::Base,
+                            None,
+                            Role::OverrideTarget,
+                            |category| {
+                                matches!(category, Category::Element(Kind::EngineeringProperty, _))
+                            },
+                        )?
+                        .id;
+                    // Replace the placeholder field after resolution so the key
+                    // and its binding share their stable override identity.
+                    self.output
+                        .occurrences
+                        .last_mut()
+                        .expect("override occurrence")
+                        .field = Field::Override(property);
+                    if lowered.contains_key(&property) {
+                        return Err(error(
+                            entry.target.span,
+                            "Duplicate resolved override target.",
+                        ));
+                    }
+                    self.budget
+                        .lowering_entries(lowered.len() + 1, entry.span)?;
+                    lowered.insert(
+                        property,
+                        self.binding(&entry.binding, Field::Override(property), None)?,
+                    );
+                }
+                (
+                    layer,
+                    SharedBody::AnalysisCase {
+                        subject,
+                        base: a::BaselineBase::ModelBaseline,
+                        overrides: lowered,
+                    },
+                )
+            }
+            _ => {
+                return Err(error(
+                    header.kind_span,
+                    "Typed declaration header/body mismatch.",
+                ));
+            }
+        };
+        self.output.elements.insert(
+            self.owner,
+            Element {
+                id: self.owner,
+                alias: header.alias.name.clone(),
+                name: header.name.clone(),
+                description,
+                parent: None,
+                body: ElementBody::shared_in(layer, body),
+            },
+        );
+        Ok(())
+    }
+
+    fn binding(
+        &mut self,
+        binding: &Binding,
+        field: Field,
+        calculation: Option<Id>,
+    ) -> Result<a::Binding, Error> {
+        match binding {
+            Binding::Unbound(_) => Ok(a::Binding::Unbound),
+            Binding::Expression(expression) => self
+                .expression(expression, field, calculation)
+                .map(a::Binding::Expression),
+        }
+    }
+
+    fn call(
+        &mut self,
+        definition: &Reference,
+        arguments: &[Argument],
+        field: Field,
+        site: usize,
+    ) -> Result<Call, Error> {
+        let calculation = self
+            .global(
+                definition,
+                field,
+                Some(site),
+                Role::CallTarget,
+                |category| category == Category::Calculation,
+            )?
+            .id;
+        let tables = self.tables;
+        let signature = &tables.parameters[&calculation];
+        let mut parameters = Vec::new();
+        let mut seen = BTreeSet::new();
+        for argument in arguments {
+            self.budget
+                .lowering_entries(parameters.len() + 1, argument.parameter.span)?;
+            let parameter = *signature.get(&argument.parameter.name).ok_or_else(|| {
+                error(
+                    argument.parameter.span,
+                    "Unknown argument name in called calculation.",
+                )
+            })?;
+            if !seen.insert(parameter) {
+                return Err(error(
+                    argument.parameter.span,
+                    "Duplicate resolved argument parameter.",
+                ));
+            }
+            self.occurrence(
+                &argument.parameter,
+                field,
+                Some(site),
+                Role::ArgumentLabel,
+                Target::Parameter {
+                    calculation,
+                    parameter,
+                },
+            )?;
+            parameters.push(parameter);
+        }
+        // Argument-set/type checking remains in existing semantic admission.
+        Ok(Call {
+            calculation,
+            parameters,
+        })
+    }
+
+    fn expression(
+        &mut self,
+        root: &Expression,
+        field: Field,
+        calculation: Option<Id>,
+    ) -> Result<a::Expr, Error> {
+        enum Work<'a> {
+            Visit(&'a Expression, Option<(usize, Child)>),
+            Build(&'a Expression, usize, Option<Call>, usize),
+        }
+        let mut work = vec![Work::Visit(root, None)];
+        let mut values = Vec::new();
+        while let Some(task) = work.pop() {
+            match task {
+                Work::Visit(expression, parent) => {
+                    self.budget
+                        .lowering_entries(self.output.expressions.len() + 1, expression.span)?;
+                    let site = self.output.expressions.len();
+                    self.output.expressions.push(ExpressionSite {
+                        file: self.file,
+                        owner: self.owner,
+                        field,
+                        parent,
+                        span: expression.span,
+                    });
+                    let call = if let ExpressionKind::Call {
+                        definition,
+                        arguments,
+                    } = &expression.kind
+                    {
+                        Some(self.call(definition, arguments, field, site)?)
+                    } else {
+                        None
+                    };
+                    let child_count = match &expression.kind {
+                        ExpressionKind::List(items) => items.len(),
+                        ExpressionKind::Call { arguments, .. } => arguments.len(),
+                        ExpressionKind::Unary { .. }
+                        | ExpressionKind::Power { .. }
+                        | ExpressionKind::AsKind { .. } => 1,
+                        ExpressionKind::Binary { .. } | ExpressionKind::Sum { .. } => 2,
+                        ExpressionKind::If { .. } => 3,
+                        _ => 0,
+                    };
+                    self.budget
+                        .lowering_entries(work.len() + child_count + 1, expression.span)?;
+                    let mut children = Vec::with_capacity(child_count);
+                    match &expression.kind {
+                        ExpressionKind::List(items) => children.extend(
+                            items
+                                .iter()
+                                .enumerate()
+                                .map(|(index, child)| (child, Child::Item(index))),
+                        ),
+                        ExpressionKind::Unary { operand, .. } => {
+                            children.push((operand.as_ref(), Child::Operand))
+                        }
+                        ExpressionKind::Binary { left, right, .. } => children
+                            .extend([(left.as_ref(), Child::Left), (right.as_ref(), Child::Right)]),
+                        ExpressionKind::If {
+                            condition,
+                            when_true,
+                            when_false,
+                        } => children.extend([
+                            (condition.as_ref(), Child::Condition),
+                            (when_true.as_ref(), Child::WhenTrue),
+                            (when_false.as_ref(), Child::WhenFalse),
+                        ]),
+                        ExpressionKind::Call { arguments, .. } => children.extend(
+                            arguments
+                                .iter()
+                                .zip(&call.as_ref().expect("call signature").parameters)
+                                .map(|(argument, id)| (&argument.value, Child::Argument(*id))),
+                        ),
+                        ExpressionKind::Sum { values, initial } => children.extend([
+                            (values.as_ref(), Child::Values),
+                            (initial.as_ref(), Child::Initial),
+                        ]),
+                        ExpressionKind::Power { base, .. } => {
+                            children.push((base.as_ref(), Child::Base))
+                        }
+                        ExpressionKind::AsKind { value, .. } => {
+                            children.push((value.as_ref(), Child::Value))
+                        }
+                        _ => {}
+                    }
+                    work.push(Work::Build(expression, site, call, children.len()));
+                    work.extend(
+                        children
+                            .into_iter()
+                            .rev()
+                            .map(|(child, edge)| Work::Visit(child, Some((site, edge)))),
+                    );
+                }
+                Work::Build(expression, site, call, count) => {
+                    let start = values.len() - count;
+                    let mut children = values.split_off(start).into_iter();
+                    let next = |children: &mut std::vec::IntoIter<a::Expr>| {
+                        Box::new(children.next().expect("visited expression child"))
+                    };
+                    use ExpressionKind as E;
+                    let value = match &expression.kind {
+                        E::Boolean(value) => a::Expr::Boolean(*value),
+                        E::Number(value) => a::Expr::Number(value.clone()),
+                        E::Quantity { magnitude, unit } => a::Expr::Quantity {
+                            magnitude: magnitude.clone(),
+                            unit: self.definition_ref(unit, field, Some(site), Category::Unit)?,
+                        },
+                        E::Property(reference) => a::Expr::Property(
+                            self.global(
+                                reference,
+                                field,
+                                Some(site),
+                                Role::Reference,
+                                |category| {
+                                    matches!(
+                                        category,
+                                        Category::Element(Kind::EngineeringProperty, _)
+                                    )
+                                },
+                            )?
+                            .id,
+                        ),
+                        E::Parameter(reference) => {
+                            let calculation = calculation.ok_or_else(|| {
+                                error(
+                                    reference.span,
+                                    "Parameter use is only valid in its calculation body.",
+                                )
+                            })?;
+                            let parameter = *self.tables.parameters[&calculation]
+                                .get(&reference.name)
+                                .ok_or_else(|| {
+                                    error(
+                                        reference.span,
+                                        "Unknown parameter in owning calculation.",
+                                    )
+                                })?;
+                            self.occurrence(
+                                reference,
+                                field,
+                                Some(site),
+                                Role::ParameterUse,
+                                Target::Parameter {
+                                    calculation,
+                                    parameter,
+                                },
+                            )?;
+                            a::Expr::Parameter(parameter)
+                        }
+                        E::List(_) => a::Expr::List(children.collect()),
+                        E::Unary { op, .. } => a::Expr::Unary {
+                            op: *op,
+                            operand: next(&mut children),
+                        },
+                        E::Binary { op, .. } => a::Expr::Binary {
+                            op: *op,
+                            left: next(&mut children),
+                            right: next(&mut children),
+                        },
+                        E::If { .. } => a::Expr::If {
+                            condition: next(&mut children),
+                            when_true: next(&mut children),
+                            when_false: next(&mut children),
+                        },
+                        E::Call { .. } => {
+                            let call = call.expect("resolved call");
+                            a::Expr::Call {
+                                definition: a::DefinitionRef::Local(call.calculation),
+                                arguments: call.parameters.into_iter().zip(children).collect(),
+                            }
+                        }
+                        E::Sum { .. } => a::Expr::Sum {
+                            values: next(&mut children),
+                            initial: next(&mut children),
+                        },
+                        E::Power { exponent, .. } => a::Expr::Power {
+                            base: next(&mut children),
+                            exponent: *exponent,
+                        },
+                        E::AsKind { kind, .. } => a::Expr::AsKind {
+                            kind: self.definition_ref(
+                                kind,
+                                field,
+                                Some(site),
+                                Category::QuantityKind,
+                            )?,
+                            value: next(&mut children),
+                        },
+                    };
+                    self.budget
+                        .lowering_entries(values.len() + 1, expression.span)?;
+                    values.push(value);
+                }
+            }
+        }
+        Ok(values.pop().expect("one lowered expression"))
+    }
+}
+
+struct Call {
+    calculation: Id,
+    parameters: Vec<a::ParameterId>,
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/lower/fixtures/ordinary-oa.arcadia

@@ -0,0 +1,7 @@
+arcadia 7;
+project response_budget "Response budget" id "4210b9f2-7046-47f0-aa3b-153f626a579d" {
+    oa_activity respond "Respond" id "cabec6a1-7d5d-48f3-8d2d-a7fc8cf78f59" {
+        oa_activity receive "Receive" id "4ab9a8a7-7552-488d-9862-e14b89e7b353" {}
+        oa_activity dispatch "Dispatch" id "6df991ba-4c5e-4535-99e2-524ae274ee8b" {}
+    }
+}

crates/oa-core/src/language/analysis_source/lower/fixtures/ordinary-sa.arcadia

@@ -0,0 +1,7 @@
+arcadia 7;
+project response_budget "Response budget" id "c210b9f2-7046-47f0-aa3b-153f626a579d" {
+    sa_function respond "Respond" id "4abec6a1-7d5d-48f3-8d2d-a7fc8cf78f59" {
+        sa_function receive "Receive" id "cab9a8a7-7552-488d-9862-e14b89e7b353" {}
+        sa_function dispatch "Dispatch" id "edf991ba-4c5e-4535-99e2-524ae274ee8b" {}
+    }
+}

crates/oa-core/src/language/analysis_source/lower/fixtures/typed-oa.arcadia

@@ -0,0 +1,43 @@
+// Staged typed roots from the r2 example; ordinary roots are supplied separately.
+// Forward uses precede the neutral definitions. 雪 keeps offsets UTF-8 sensitive.
+oa_property receive_time "Receive time" id "63a931c2-675a-4fce-89e5-04361cb99450" {
+    subject @receive; type Quantity(@duration); display_unit @millisecond;
+    base 750 [@millisecond];
+}
+oa_property dispatch_time "Dispatch time" id "c33fc772-2a60-4044-9af9-73c61c563ace" {
+    subject @dispatch; type Quantity(@duration); display_unit @second;
+    base 1 [@second];
+}
+oa_property total_time "Total time" id "bd5b68e8-65fc-4e35-9071-a73061316a4b" {
+    subject @respond; type Quantity(@duration); display_unit @second;
+    base @combine(a: @receive_time, b: @dispatch_time);
+}
+oa_property limit "Allowed duration" id "437bedbb-2cf4-44ee-a139-6563cc5086ec" {
+    subject @respond; type Quantity(@duration); display_unit @second;
+    base 2 [@second];
+}
+oa_check budget "Response budget" id "bac0de99-9d2f-4e53-9158-d424ecac61bf" {
+    subject none; documented_constraint none; predicate @total_time <= @limit;
+}
+oa_analysis degraded "Degraded radio" id "38036c65-16d4-449c-837b-91eb141c1d93" {
+    subject none; base ModelBaseline;
+    overrides { @receive_time = 1250 [@millisecond]; };
+}
+oa_analysis unmeasured "Unmeasured radio" id "99d3e09a-0ec3-4194-9dd4-9f3de6625cde" {
+    subject none; base ModelBaseline;
+    overrides { @receive_time = unbound; };
+}
+calculation combine "Combine durations" id "fd7ce7ab-f789-40bc-b699-0c37f1b6902f" {
+    input a id "28ff40b0-1b8f-4735-8536-5a6ab21b56cb" : Quantity(@duration);
+    input b id "7a47cc1e-8ae5-4551-b2d8-8a68108e0976" : Quantity(@duration);
+    result Quantity(@duration); body $a + $b;
+}
+unit second "Second" id "534f4672-1ba5-4157-8b0a-b9cf41d0a3ce" {
+    kind @duration; scale 1; offset 0; symbol "s";
+}
+unit millisecond "Millisecond" id "39053f37-fec9-4708-9f0a-3959d223f891" {
+    kind @duration; scale ratio(1, 1000); offset 0; symbol "ms";
+}
+quantity_kind duration "Duration" id "188b911c-5f8b-431c-9eea-2d41f3953767" {
+    dimension { time 1; }; algebra Linear;
+}

crates/oa-core/src/language/analysis_source/lower/fixtures/typed-sa.arcadia

@@ -0,0 +1,43 @@
+// Staged typed roots from the r2 example; ordinary roots are supplied separately.
+// Forward uses precede the neutral definitions. 雪 keeps offsets UTF-8 sensitive.
+sa_property receive_time "Receive time" id "e3a931c2-675a-4fce-89e5-04361cb99450" {
+    subject @receive; type Quantity(@duration); display_unit @millisecond;
+    base 750 [@millisecond];
+}
+sa_property dispatch_time "Dispatch time" id "433fc772-2a60-4044-9af9-73c61c563ace" {
+    subject @dispatch; type Quantity(@duration); display_unit @second;
+    base 1 [@second];
+}
+sa_property total_time "Total time" id "3d5b68e8-65fc-4e35-9071-a73061316a4b" {
+    subject @respond; type Quantity(@duration); display_unit @second;
+    base @combine(a: @receive_time, b: @dispatch_time);
+}
+sa_property limit "Allowed duration" id "c37bedbb-2cf4-44ee-a139-6563cc5086ec" {
+    subject @respond; type Quantity(@duration); display_unit @second;
+    base 2 [@second];
+}
+sa_check budget "Response budget" id "3ac0de99-9d2f-4e53-9158-d424ecac61bf" {
+    subject none; documented_constraint none; predicate @total_time <= @limit;
+}
+sa_analysis degraded "Degraded radio" id "b8036c65-16d4-449c-837b-91eb141c1d93" {
+    subject none; base ModelBaseline;
+    overrides { @receive_time = 1250 [@millisecond]; };
+}
+sa_analysis unmeasured "Unmeasured radio" id "19d3e09a-0ec3-4194-9dd4-9f3de6625cde" {
+    subject none; base ModelBaseline;
+    overrides { @receive_time = unbound; };
+}
+calculation combine "Combine durations" id "7d7ce7ab-f789-40bc-b699-0c37f1b6902f" {
+    input a id "28ff40b0-1b8f-4735-8536-5a6ab21b56cb" : Quantity(@duration);
+    input b id "7a47cc1e-8ae5-4551-b2d8-8a68108e0976" : Quantity(@duration);
+    result Quantity(@duration); body $a + $b;
+}
+unit second "Second" id "d34f4672-1ba5-4157-8b0a-b9cf41d0a3ce" {
+    kind @duration; scale 1; offset 0; symbol "s";
+}
+unit millisecond "Millisecond" id "b9053f37-fec9-4708-9f0a-3959d223f891" {
+    kind @duration; scale ratio(1, 1000); offset 0; symbol "ms";
+}
+quantity_kind duration "Duration" id "988b911c-5f8b-431c-9eea-2d41f3953767" {
+    dimension { time 1; }; algebra Linear;
+}

crates/oa-core/src/language/analysis_source/lower/tests.rs

@@ -0,0 +1,888 @@
+use super::*;
+use crate::language::ParseLimits;
+use crate::language::analysis_source::{budget::Limits, cursor::Cursor};
+
+use super::super::model_oracle as oracle;
+
+const OA: &str = include_str!("fixtures/typed-oa.arcadia");
+const SA: &str = include_str!("fixtures/typed-sa.arcadia");
+const ORDINARY_OA: &str = include_str!("fixtures/ordinary-oa.arcadia");
+const ORDINARY_SA: &str = include_str!("fixtures/ordinary-sa.arcadia");
+
+fn budget() -> Budget {
+    Budget::new(Limits::source8(ParseLimits::UNLIMITED)).unwrap()
+}
+fn id(text: &str) -> Id {
+    Id::parse_str(text).unwrap()
+}
+fn by_alias(project: &Project, alias: &str) -> Id {
+    project
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+fn ordinary(source: &str) -> Project {
+    crate::language::parse(source).unwrap()
+}
+fn unit(source: &str, file: usize, budget: &mut Budget) -> Unit {
+    let tokens = lex::tokens(source, budget).unwrap();
+    let mut cursor = Cursor::new(source, &tokens, budget);
+    let mut declarations = Vec::new();
+    while cursor.cursor < tokens.len() {
+        declarations.push(d::parse(&mut cursor, 8, None).unwrap());
+    }
+    Unit { file, declarations }
+}
+fn merge(mut ordinary: Project, lowered: Lowered) -> Project {
+    ordinary.definitions.extend(lowered.definitions);
+    ordinary.elements.extend(lowered.elements);
+    ordinary
+}
+fn admit(project: &Project) {
+    a::admit(project, a::AdmissionLimits::REFERENCE).unwrap();
+}
+fn failure(source: &str, ordinary: &Project) -> Failure {
+    let mut budget = budget();
+    let unit = unit(source, 7, &mut budget);
+    lower(ordinary, &[unit], &budget).unwrap_err()
+}
+
+#[test]
+fn staged_oa_and_sa_lowering_match_complete_independent_17_uuid_oracles() {
+    for (layer, ordinary_source, typed_source) in
+        [(Layer::Oa, ORDINARY_OA, OA), (Layer::Sa, ORDINARY_SA, SA)]
+    {
+        let expected = oracle::project(layer);
+        assert_eq!(expected.name, "Response budget");
+        assert_eq!(expected.identities().len(), 15); // two additional scoped IDs
+        for (alias, name) in oracle::NAMES {
+            let object = by_alias(&expected, alias);
+            let actual_name = expected
+                .definitions
+                .get(&object)
+                .map(|value| value.name.as_str())
+                .or_else(|| {
+                    expected
+                        .elements
+                        .get(&object)
+                        .map(|value| value.name.as_str())
+                })
+                .unwrap();
+            assert_eq!(actual_name, name);
+            assert_ne!(actual_name, alias);
+        }
+        let mut budget = budget();
+        let units = [unit(typed_source, 17, &mut budget)];
+        let usage = budget.usage;
+        let numeric = budget.numeric_units();
+        let skeleton = ordinary(ordinary_source);
+        let first = lower(&skeleton, &units, &budget).unwrap();
+        let second = lower(&skeleton, &units, &budget).unwrap();
+        assert_eq!(first.occurrences, second.occurrences);
+        assert_eq!(first.expressions, second.expressions);
+        assert_eq!(budget.usage, usage);
+        assert_eq!(budget.numeric_units(), numeric);
+        assert_eq!(
+            first
+                .occurrences
+                .iter()
+                .filter(|occurrence| occurrence.role != Role::ParameterDeclaration)
+                .count(),
+            usage.references
+        );
+        let actual = merge(skeleton, first);
+        assert_eq!(actual, expected);
+        admit(&actual); // the complete model's one semantic admission
+    }
+    assert!(crate::language::parse(&ORDINARY_OA.replacen("arcadia 7", "arcadia 8", 1)).is_err());
+}
+
+#[test]
+fn forward_cross_unit_resolution_keeps_original_offsets_and_shared_work() {
+    let source = OA.replace('\n', "\r\n");
+    let split = source.find("calculation combine").unwrap();
+    let sources = [&source[..split], &source[split..]];
+    let mut budget = budget();
+    let mut units = [
+        unit(sources[0], 4, &mut budget),
+        unit(sources[1], 9, &mut budget),
+    ];
+    let usage = budget.usage;
+    assert_eq!(usage.bytes, source.len());
+    let lowered = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap();
+    units.reverse();
+    // This second order uses the same bounded lowerer; output models must not
+    // depend on declaration/file traversal order. It is not an include parser.
+    let reordered = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap();
+    assert_eq!(
+        merge(ordinary(ORDINARY_OA), reordered),
+        oracle::project(Layer::Oa)
+    );
+    for occurrence in &lowered.occurrences {
+        let source = if occurrence.file == 4 {
+            sources[0]
+        } else {
+            assert_eq!(occurrence.file, 9);
+            sources[1]
+        };
+        let text = &source[occurrence.span.start..occurrence.span.end];
+        assert!(crate::valid_alias(text));
+        assert!(!text.starts_with('@') && !text.starts_with('$'));
+    }
+    assert_eq!(budget.usage, usage);
+    assert_eq!(
+        merge(ordinary(ORDINARY_OA), lowered),
+        oracle::project(Layer::Oa)
+    );
+}
+
+fn number(value: i64) -> a::Expr {
+    a::Expr::Number(crate::analysis_numeric::Exact::from_integer(value))
+}
+fn binary(op: a::BinaryOp, left: a::Expr, right: a::Expr) -> a::Expr {
+    a::Expr::Binary {
+        op,
+        left: Box::new(left),
+        right: Box::new(right),
+    }
+}
+
+#[test]
+fn all_thirteen_expression_variants_lower_to_real_typed_values_and_admit() {
+    let mut project = oracle::project(Layer::Oa);
+    let duration = by_alias(&project, "duration");
+    let second = by_alias(&project, "second");
+    let property = by_alias(&project, "receive_time");
+    let owner = by_alias(&project, "total_time");
+    let calculation = by_alias(&project, "combine");
+    let parameter = a::ParameterId(id("28ff40b0-1b8f-4735-8536-5a6ab21b56cb"));
+    let b = a::ParameterId(id("7a47cc1e-8ae5-4551-b2d8-8a68108e0976"));
+    let quantity =
+        a::AnalysisType::Scalar(a::ScalarType::Quantity(a::DefinitionRef::Local(duration)));
+    let numeric = a::AnalysisType::Scalar(a::ScalarType::Number);
+    let boolean = a::AnalysisType::Scalar(a::ScalarType::Boolean);
+    let cases = [
+        ("true", a::Expr::Boolean(true), boolean.clone()),
+        (
+            "ratio(3, 2)",
+            a::Expr::Number(
+                Exact::from_wire(
+                    &crate::analysis_numeric::ExactWire {
+                        numerator: "3".into(),
+                        denominator: "2".into(),
+                    },
+                    &mut crate::analysis_numeric::WorkMeter::new(
+                        crate::analysis_numeric::WorkLimits::REFERENCE,
+                    ),
+                )
+                .unwrap(),
+            ),
+            numeric.clone(),
+        ),
+        (
+            "2 [@second]",
+            a::Expr::Quantity {
+                magnitude: Exact::from_integer(2),
+                unit: a::DefinitionRef::Local(second),
+            },
+            quantity.clone(),
+        ),
+        (
+            "@receive_time",
+            a::Expr::Property(property),
+            quantity.clone(),
+        ),
+        ("$a", a::Expr::Parameter(parameter), quantity.clone()),
+        (
+            "[1, 2]",
+            a::Expr::List(vec![number(1), number(2)]),
+            a::AnalysisType::List(a::ScalarType::Number),
+        ),
+        (
+            "abs(-2)",
+            a::Expr::Unary {
+                op: a::UnaryOp::Absolute,
+                operand: Box::new(a::Expr::Unary {
+                    op: a::UnaryOp::Negate,
+                    operand: Box::new(number(2)),
+                }),
+            },
+            numeric.clone(),
+        ),
+        (
+            "1 + 2",
+            binary(a::BinaryOp::Add, number(1), number(2)),
+            numeric.clone(),
+        ),
+        (
+            "if(true, 1, 2)",
+            a::Expr::If {
+                condition: Box::new(a::Expr::Boolean(true)),
+                when_true: Box::new(number(1)),
+                when_false: Box::new(number(2)),
+            },
+            numeric.clone(),
+        ),
+        (
+            "@combine(b: 2 [@second], a: 1 [@second])",
+            a::Expr::Call {
+                definition: a::DefinitionRef::Local(calculation),
+                arguments: BTreeMap::from([
+                    (
+                        parameter,
+                        a::Expr::Quantity {
+                            magnitude: Exact::from_integer(1),
+                            unit: a::DefinitionRef::Local(second),
+                        },
+                    ),
+                    (
+                        b,
+                        a::Expr::Quantity {
+                            magnitude: Exact::from_integer(2),
+                            unit: a::DefinitionRef::Local(second),
+                        },
+                    ),
+                ]),
+            },
+            quantity.clone(),
+        ),
+        (
+            "sum([1, 2], 0)",
+            a::Expr::Sum {
+                values: Box::new(a::Expr::List(vec![number(1), number(2)])),
+                initial: Box::new(number(0)),
+            },
+            numeric.clone(),
+        ),
+        (
+            "power(2, -2)",
+            a::Expr::Power {
+                base: Box::new(number(2)),
+                exponent: -2,
+            },
+            numeric.clone(),
+        ),
+        (
+            "as_kind(@duration, power(1 [@second], 2) / 1 [@second])",
+            a::Expr::AsKind {
+                kind: a::DefinitionRef::Local(duration),
+                value: Box::new(binary(
+                    a::BinaryOp::Divide,
+                    a::Expr::Power {
+                        base: Box::new(a::Expr::Quantity {
+                            magnitude: Exact::from_integer(1),
+                            unit: a::DefinitionRef::Local(second),
+                        }),
+                        exponent: 2,
+                    },
+                    a::Expr::Quantity {
+                        magnitude: Exact::from_integer(1),
+                        unit: a::DefinitionRef::Local(second),
+                    },
+                )),
+            },
+            quantity.clone(),
+        ),
+    ];
+    // Remove the original check's dependent quantity comparison: each case
+    // installs a different declared result type on total_time below.
+    project.elements.remove(&by_alias(&project, "budget"));
+    for (source, expected, result_type) in cases {
+        let mut budget = budget();
+        let Binding::Expression(syntax) = super::super::parse(source, &mut budget).unwrap() else {
+            panic!("expression")
+        };
+        let mut tables = Tables::default();
+        tables.ordinary(&project, &budget).unwrap();
+        let mut output = Lowered {
+            definitions: BTreeMap::new(),
+            elements: BTreeMap::new(),
+            occurrences: Vec::new(),
+            expressions: Vec::new(),
+        };
+        let is_parameter = source == "$a";
+        let expression_owner = if is_parameter { calculation } else { owner };
+        let actual = Resolver {
+            tables: &tables,
+            output: &mut output,
+            budget: &budget,
+            file: 3,
+            owner: expression_owner,
+        }
+        .expression(
+            &syntax,
+            if is_parameter {
+                Field::Body
+            } else {
+                Field::Base
+            },
+            is_parameter.then_some(calculation),
+        )
+        .unwrap();
+        assert_eq!(actual, expected, "{source}");
+        assert_eq!(output.expressions[0].span, syntax.span);
+        assert!(output.expressions[0].parent.is_none());
+        let mut candidate = project.clone();
+        if is_parameter {
+            let a::DefinitionBody::Calculation(definition) =
+                &mut candidate.definitions.get_mut(&calculation).unwrap().body
+            else {
+                panic!("calculation")
+            };
+            definition.body = a::Binding::Expression(actual);
+        } else {
+            let SharedBody::EngineeringProperty {
+                value_type,
+                display_unit,
+                base,
+                ..
+            } = candidate
+                .elements
+                .get_mut(&owner)
+                .unwrap()
+                .body
+                .shared_mut()
+                .unwrap()
+            else {
+                panic!("property")
+            };
+            *value_type = result_type;
+            *display_unit = None;
+            *base = a::Binding::Expression(actual);
+        }
+        admit(&candidate);
+    }
+}
+
+#[test]
+fn call_sites_and_parameter_scopes_preserve_distinct_original_occurrences() {
+    let source = OA.replace("base @combine(a: @receive_time, b: @dispatch_time);", "base @combine(a: @receive_time, // first\n b: @dispatch_time) + @combine(// second\n b: @dispatch_time, a: @receive_time);") + r#"
+calculation other "Other" id "00000000-0000-0000-0000-000000000020" {
+    input a id "28ff40b0-1b8f-4735-8536-5a6ab21b56cb" : Number;
+    result Number; body $a;
+}
+quantity_kind collision "Global ID equals a scoped ID" id "28ff40b0-1b8f-4735-8536-5a6ab21b56cb" { dimension {}; algebra Linear; }
+calculation caller "Caller" id "00000000-0000-0000-0000-000000000021" {
+    input a id "00000000-0000-0000-0000-000000000022" : Number;
+    result Number; body @other(a: $a) + @other(a: 3);
+}
+"#;
+    let mut budget = budget();
+    let units = [unit(&source, 2, &mut budget)];
+    let output = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap();
+    let total = id("bd5b68e8-65fc-4e35-9071-a73061316a4b");
+    let combine = id("fd7ce7ab-f789-40bc-b699-0c37f1b6902f");
+    let labels: Vec<_> = output
+        .occurrences
+        .iter()
+        .filter(|value| value.owner == total && value.role == Role::ArgumentLabel)
+        .collect();
+    assert_eq!(labels.len(), 4);
+    assert_eq!(
+        labels
+            .iter()
+            .map(|value| value.span.start)
+            .collect::<BTreeSet<_>>()
+            .len(),
+        4
+    );
+    let sites: BTreeSet<_> = labels
+        .iter()
+        .map(|value| value.expression.unwrap())
+        .collect();
+    assert_eq!(sites.len(), 2);
+    let paths: Vec<_> = sites
+        .iter()
+        .map(|site| output.expressions[*site].parent.unwrap().1)
+        .collect();
+    assert_eq!(paths, [Child::Left, Child::Right]);
+    for label in labels {
+        assert_eq!(label.field, Field::Base);
+        assert!(
+            matches!(label.target, Target::Parameter { calculation, .. } if calculation == combine)
+        );
+        assert!(matches!(
+            &source[label.span.start..label.span.end],
+            "a" | "b"
+        ));
+    }
+    let reused = a::ParameterId(id("28ff40b0-1b8f-4735-8536-5a6ab21b56cb"));
+    let scopes: BTreeSet<_> = output
+        .occurrences
+        .iter()
+        .filter_map(|occurrence| match occurrence.target {
+            Target::Parameter {
+                calculation,
+                parameter,
+            } if parameter == reused => Some(calculation),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(
+        scopes,
+        BTreeSet::from([combine, id("00000000-0000-0000-0000-000000000020")])
+    );
+    let caller = id("00000000-0000-0000-0000-000000000021");
+    let use_in_caller = output
+        .occurrences
+        .iter()
+        .find(|value| value.owner == caller && value.role == Role::ParameterUse)
+        .unwrap();
+    assert_eq!(
+        use_in_caller.target,
+        Target::Parameter {
+            calculation: caller,
+            parameter: a::ParameterId(id("00000000-0000-0000-0000-000000000022"))
+        }
+    );
+    for site in &output.expressions {
+        assert_eq!(site.file, 2);
+        assert!(source.get(site.span.start..site.span.end).is_some());
+    }
+    admit(&merge(ordinary(ORDINARY_OA), output));
+}
+
+#[test]
+fn missing_ids_require_stabilization_without_uuid_or_budget_churn() {
+    for source in [
+        r#"calculation pending "Pending" { result Number; body unbound; }"#,
+        r#"calculation pending "Pending" id "00000000-0000-0000-0000-000000000040" { input value : Number; result Number; body $value; }"#,
+    ] {
+        let mut budget = budget();
+        let units = [unit(source, 3, &mut budget)];
+        let usage = budget.usage;
+        let skeleton = ordinary(ORDINARY_OA);
+        let first = lower(&skeleton, &units, &budget).unwrap_err();
+        assert_eq!(first, lower(&skeleton, &units, &budget).unwrap_err());
+        assert!(first.error.message.contains("stabilization"));
+        assert_eq!(budget.usage, usage);
+        let declaration = &units[0].declarations[0];
+        if declaration.header.identity.value.is_none() {
+            assert!(declaration.header.identity.insertion.is_some());
+        } else {
+            let d::Body::Calculation { parameters, .. } = &declaration.body else {
+                panic!("calculation")
+            };
+            assert!(parameters[0].identity.value.is_none());
+            assert!(parameters[0].identity.insertion.is_some());
+        }
+    }
+}
+
+#[test]
+fn duplicate_global_aliases_and_ids_fail_before_body_resolution() {
+    let ordinary = ordinary(ORDINARY_OA);
+    for (source, message) in [
+        (
+            OA.replace("quantity_kind duration", "quantity_kind respond"),
+            "Duplicate global alias",
+        ),
+        (
+            OA.replace(
+                "188b911c-5f8b-431c-9eea-2d41f3953767",
+                "cabec6a1-7d5d-48f3-8d2d-a7fc8cf78f59",
+            ),
+            "Duplicate global identity",
+        ),
+        (format!("{OA}\n{OA}"), "Duplicate global"),
+    ] {
+        let failed = failure(&source, &ordinary);
+        assert_eq!(failed.file, Some(7));
+        assert!(failed.error.message.contains(message), "{:?}", failed);
+        assert!(!failed.error.message.contains("Unknown"));
+    }
+    let mut budget = budget();
+    let units = [unit(OA, 3, &mut budget), unit(OA, 5, &mut budget)];
+    let failed = lower(&ordinary, &units, &budget).unwrap_err();
+    assert_eq!(failed.file, Some(5));
+    assert!(failed.error.message.contains("Duplicate global identity"));
+}
+
+#[test]
+fn typed_reference_domains_unknown_names_and_parameter_scope_fail_at_tokens() {
+    let skeleton = ordinary(ORDINARY_OA);
+    for (old, new, token, message) in [
+        (
+            "subject @receive",
+            "subject @second",
+            "second",
+            "Wrong reference domain",
+        ),
+        (
+            "Quantity(@duration)",
+            "Quantity(@second)",
+            "second",
+            "Wrong reference domain",
+        ),
+        (
+            "display_unit @second",
+            "display_unit @duration",
+            "duration",
+            "Wrong reference domain",
+        ),
+        (
+            "750 [@millisecond]",
+            "750 [@duration]",
+            "duration",
+            "Wrong reference domain",
+        ),
+        (
+            "base 1 [@second]",
+            "base @respond",
+            "respond",
+            "Wrong reference domain",
+        ),
+        (
+            "@combine(a:",
+            "@second(a:",
+            "second",
+            "Wrong reference domain",
+        ),
+        (
+            "@combine(a:",
+            "@combine(unknown:",
+            "unknown",
+            "Unknown argument",
+        ),
+        (
+            "body $a + $b",
+            "body $outside + $b",
+            "outside",
+            "Unknown parameter",
+        ),
+        (
+            "base 1 [@second]",
+            "base $a",
+            "a",
+            "only valid in its calculation",
+        ),
+        (
+            "subject @receive",
+            "subject @missing",
+            "missing",
+            "Unknown global",
+        ),
+        (
+            "documented_constraint none",
+            "documented_constraint @respond",
+            "respond",
+            "Wrong reference domain",
+        ),
+        (
+            "@receive_time = unbound",
+            "@second = unbound",
+            "second",
+            "Wrong reference domain",
+        ),
+    ] {
+        let source = OA.replace(old, new);
+        assert_ne!(source, OA, "mutation {old}");
+        let failed = failure(&source, &skeleton);
+        assert!(
+            failed.error.message.contains(message),
+            "{new}: {:?}",
+            failed
+        );
+        assert_eq!(
+            &source[failed.error.span.start..failed.error.span.end],
+            token
+        );
+    }
+}
+
+#[test]
+fn ordinary_non_element_categories_are_collected_and_never_property_fallbacks() {
+    let mut skeleton = ordinary(ORDINARY_OA);
+    let respond = by_alias(&skeleton, "respond");
+    let receive = by_alias(&skeleton, "receive");
+    let relation = Id::from_u128(100);
+    skeleton.relations.insert(
+        relation,
+        crate::Relation {
+            id: relation,
+            alias: "link".into(),
+            name: "Link".into(),
+            description: String::new(),
+            body: crate::RelationBody::new(
+                crate::RelationKind::FunctionalExchange,
+                respond,
+                receive,
+            ),
+        },
+    );
+    let diagram = skeleton.ensure_diagram(Layer::Oa);
+    skeleton.diagrams.get_mut(&diagram).unwrap().alias = "view".into();
+    let node = skeleton.place(diagram, respond, crate::Position { x: 0., y: 0. });
+    skeleton
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .get_mut(&node)
+        .unwrap()
+        .alias = "placement".into();
+    let artifact = Id::from_u128(101);
+    skeleton.artifact_links.insert(
+        artifact,
+        crate::ArtifactLink {
+            id: artifact,
+            alias: "document".into(),
+            name: "Document".into(),
+            description: String::new(),
+            owner: respond,
+            relation: crate::ArtifactRelation::References,
+            uri: "urn:test".into(),
+            revision: None,
+            fragment: None,
+        },
+    );
+    let trace = Id::from_u128(102);
+    skeleton.traces.insert(
+        trace,
+        crate::Trace {
+            id: trace,
+            alias: "mapping".into(),
+            name: "Mapping".into(),
+            description: String::new(),
+            oa: respond,
+            sa: receive,
+            kind: crate::TraceKind::Manual,
+            baseline: None,
+        },
+    );
+    // Resolution classification is independent of whole-model admission; the
+    // synthetic trace is deliberately not asserted to be a valid OA/SA trace.
+    let budget = budget();
+    let mut tables = Tables::default();
+    tables.ordinary(&skeleton, &budget).unwrap();
+    for (alias, category) in [
+        ("response_budget", Category::Project),
+        ("link", Category::Relation),
+        ("view", Category::Diagram),
+        ("placement", Category::Node),
+        ("document", Category::Artifact),
+        ("mapping", Category::Trace),
+    ] {
+        assert_eq!(tables.aliases[alias].category, category);
+        let failed = failure(
+            &OA.replace("base 1 [@second]", &format!("base @{alias}")),
+            &skeleton,
+        );
+        assert!(
+            failed.error.message.contains("Wrong reference domain"),
+            "{:?}",
+            failed
+        );
+    }
+    let source = OA.replace("subject @receive", "subject @link");
+    let mut budget = self::budget();
+    let units = [unit(&source, 1, &mut budget)];
+    let output = lower(&skeleton, &units, &budget).unwrap();
+    let property = output
+        .elements
+        .values()
+        .find(|value| value.alias == "receive_time")
+        .unwrap();
+    assert!(
+        matches!(property.body.shared(), Some(SharedBody::EngineeringProperty { subject: a::AnalysisSubject::Relation(value), .. }) if *value == relation)
+    );
+}
+
+#[test]
+fn structural_lowering_defers_type_purity_layer_and_argument_sets_to_admission() {
+    for (old, new) in [
+        ("base 750 [@millisecond]", "base true"),
+        (
+            "base 750 [@millisecond]",
+            "base as_kind(@duration, 1 [@second])",
+        ),
+        ("body $a + $b", "body @receive_time"),
+        ("a: @receive_time, b: @dispatch_time", "a: @receive_time"),
+        ("oa_property receive_time", "sa_property receive_time"),
+        ("base 1 [@second]", "base @dispatch_time"),
+    ] {
+        let source = OA.replace(old, new);
+        let mut budget = budget();
+        let units = [unit(&source, 1, &mut budget)];
+        let output = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap();
+        let project = merge(ordinary(ORDINARY_OA), output);
+        assert!(
+            a::admit(&project, a::AdmissionLimits::REFERENCE).is_err(),
+            "{new}"
+        );
+    }
+}
+
+#[test]
+fn lowering_phase_bounds_count_ordinary_globals_and_scoped_parameters_together() {
+    let ordinary = oracle::project(Layer::Oa);
+    for (maximum, passes) in [(0, false), (16, false), (17, true)] {
+        let mut limits = Limits::source8(ParseLimits::UNLIMITED);
+        limits.entries = maximum;
+        let budget = Budget::new(limits).unwrap();
+        let result = lower(&ordinary, &[], &budget);
+        assert_eq!(result.is_ok(), passes, "entry bound {maximum}");
+        if let Err(failure) = result {
+            assert!(failure.error.message.contains("lowering entry limit"));
+            assert_eq!(failure.file, None);
+        }
+        assert_eq!(budget.usage, budget::Usage::default());
+    }
+}
+
+#[test]
+fn affine_kinds_optional_fields_list_signatures_and_unused_unbound_definitions_survive() {
+    let source = r#"
+unit celsius "Celsius" id "00000000-0000-0000-0000-000000000061" {
+    kind @point; scale 1; offset ratio(27315, 100); symbol "°C";
+}
+quantity_kind point "Temperature point" id "00000000-0000-0000-0000-000000000062" {
+    dimension { temperature 1; }; algebra Affine(@interval);
+}
+quantity_kind interval "Temperature interval" id "00000000-0000-0000-0000-000000000063" {
+    dimension { temperature 1; }; algebra Linear;
+}
+calculation unused "Unused list calculation" id "00000000-0000-0000-0000-000000000064" {
+    input xs id "00000000-0000-0000-0000-000000000065" : List(Quantity(@interval));
+    result List(Quantity(@interval)); body unbound; description "保留";
+}
+calculation empty "Empty calculation" id "00000000-0000-0000-0000-000000000066" {
+    result Boolean; body unbound;
+}
+oa_property ambient "Ambient temperature" id "00000000-0000-0000-0000-000000000067" {
+    subject @respond; type Quantity(@point); display_unit none; base 0 [@celsius]; parent none;
+}
+oa_check documented "Documented check" id "00000000-0000-0000-0000-000000000068" {
+    subject @respond; documented_constraint @requirement; predicate unbound;
+}
+oa_analysis changed "Changed temperature" id "00000000-0000-0000-0000-000000000069" {
+    subject @respond; base ModelBaseline; overrides { @ambient = unbound; };
+}
+"#;
+    let mut skeleton = ordinary(ORDINARY_OA);
+    let requirement = Id::from_u128(70);
+    skeleton.elements.insert(
+        requirement,
+        Element {
+            id: requirement,
+            alias: "requirement".into(),
+            name: "Requirement".into(),
+            description: String::new(),
+            parent: None,
+            body: ElementBody::shared_in(
+                Layer::Oa,
+                SharedBody::Constraint {
+                    expression: String::new(),
+                    constrained: Vec::new(),
+                },
+            ),
+        },
+    );
+    let mut budget = budget();
+    let units = [unit(source, 8, &mut budget)];
+    let output = lower(&skeleton, &units, &budget).unwrap();
+    assert_eq!(output.definitions.len(), 5);
+    let point = id("00000000-0000-0000-0000-000000000062");
+    let interval = id("00000000-0000-0000-0000-000000000063");
+    let a::DefinitionBody::QuantityKind(kind) = &output.definitions[&point].body else {
+        panic!("quantity kind")
+    };
+    assert_eq!(
+        kind.algebra,
+        a::QuantityAlgebra::Affine {
+            difference: a::DefinitionRef::Local(interval)
+        }
+    );
+    let unused = &output.definitions[&id("00000000-0000-0000-0000-000000000064")];
+    assert_eq!(unused.description, "保留");
+    let a::DefinitionBody::Calculation(calculation) = &unused.body else {
+        panic!("calculation")
+    };
+    assert_eq!(calculation.body, a::Binding::Unbound);
+    assert_eq!(
+        calculation.parameters[0].value_type,
+        a::AnalysisType::List(a::ScalarType::Quantity(a::DefinitionRef::Local(interval)))
+    );
+    assert_eq!(calculation.result, calculation.parameters[0].value_type);
+    assert!(
+        output
+            .occurrences
+            .iter()
+            .any(|occurrence| occurrence.field == Field::DocumentedConstraint
+                && occurrence.target == Target::Global(requirement))
+    );
+    let override_id = id("00000000-0000-0000-0000-000000000067");
+    assert!(output.occurrences.iter().any(|occurrence| occurrence.field
+        == Field::Override(override_id)
+        && occurrence.role == Role::OverrideTarget));
+    assert!(
+        output
+            .occurrences
+            .iter()
+            .any(|occurrence| occurrence.owner == point
+                && occurrence.field == Field::Algebra
+                && occurrence.target == Target::Global(interval))
+    );
+    admit(&merge(skeleton, output));
+}
+
+#[test]
+fn duplicate_file_keys_and_exhausted_shared_budget_cannot_enter_lowering() {
+    let mut budget = budget();
+    let units = [unit("", 3, &mut budget), unit("", 3, &mut budget)];
+    let failed = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap_err();
+    assert_eq!(failed.file, Some(3));
+    assert!(failed.error.message.contains("Duplicate source file"));
+    let failure = budget
+        .bytes(usize::MAX, Span { start: 5, end: 6 })
+        .unwrap_err();
+    let failed = lower(&ordinary(ORDINARY_OA), &[], &budget).unwrap_err();
+    assert_eq!(failed.error, failure);
+}
+
+#[test]
+fn iterative_lowering_preserves_128_deep_and_1024_wide_accepted_expressions() {
+    let deep = format!("{}1{}", "abs(".repeat(127), ")".repeat(127));
+    let wide = std::iter::repeat_n("1", 1024)
+        .collect::<Vec<_>>()
+        .join(", ");
+    let source = format!(
+        r#"
+calculation deep "Deep" id "00000000-0000-0000-0000-000000000081" {{ result Number; body {deep}; }}
+calculation wide "Wide" id "00000000-0000-0000-0000-000000000082" {{ result List(Number); body [{wide}]; }}
+"#
+    );
+    let mut budget = budget();
+    let units = [unit(&source, 1, &mut budget)];
+    let usage = budget.usage;
+    let output = lower(&ordinary(ORDINARY_OA), &units, &budget).unwrap();
+    assert_eq!(output.expressions.len(), 128 + 1025);
+    let a::DefinitionBody::Calculation(deep) = &output.definitions[&Id::from_u128(0x81)].body
+    else {
+        panic!("deep calculation")
+    };
+    let a::Binding::Expression(root) = &deep.body else {
+        panic!("deep expression")
+    };
+    let mut current = root;
+    let mut depth = 1;
+    while let a::Expr::Unary { operand, .. } = current {
+        depth += 1;
+        current = operand;
+    }
+    assert_eq!(depth, 128);
+    assert_eq!(current, &number(1));
+    let a::DefinitionBody::Calculation(wide) = &output.definitions[&Id::from_u128(0x82)].body
+    else {
+        panic!("wide calculation")
+    };
+    let a::Binding::Expression(a::Expr::List(values)) = &wide.body else {
+        panic!("wide list")
+    };
+    assert_eq!(values.len(), 1024);
+    assert!(values.iter().all(|value| *value == number(1)));
+    assert_eq!(budget.usage, usage);
+    admit(&merge(ordinary(ORDINARY_OA), output));
+}

crates/oa-core/src/language/analysis_source/model_oracle.rs

@@ -0,0 +1,263 @@
+//! Independent model construction: never parses source or calls the writer.
+use crate::analysis::*;
+use crate::analysis_numeric::{Dimension, Exact, ExactWire, WorkLimits, WorkMeter};
+use crate::*;
+use std::collections::BTreeMap;
+
+pub(super) const NAMES: [(&str, &str); 14] = [
+    ("duration", "Duration"),
+    ("second", "Second"),
+    ("millisecond", "Millisecond"),
+    ("combine", "Combine durations"),
+    ("respond", "Respond"),
+    ("receive", "Receive"),
+    ("dispatch", "Dispatch"),
+    ("receive_time", "Receive time"),
+    ("dispatch_time", "Dispatch time"),
+    ("total_time", "Total time"),
+    ("limit", "Allowed duration"),
+    ("budget", "Response budget"),
+    ("degraded", "Degraded radio"),
+    ("unmeasured", "Unmeasured radio"),
+];
+
+fn named(alias: &str) -> String {
+    NAMES
+        .iter()
+        .find(|(key, _)| *key == alias)
+        .unwrap()
+        .1
+        .into()
+}
+fn local(id: Id) -> DefinitionRef {
+    DefinitionRef::Local(id)
+}
+fn quantity(value: i64, unit: Id) -> Expr {
+    Expr::Quantity {
+        magnitude: Exact::from_integer(value),
+        unit: local(unit),
+    }
+}
+fn expression(value: Expr) -> Binding {
+    Binding::Expression(value)
+}
+fn binary(op: BinaryOp, left: Expr, right: Expr) -> Expr {
+    Expr::Binary {
+        op,
+        left: Box::new(left),
+        right: Box::new(right),
+    }
+}
+
+pub(super) fn project(layer: Layer) -> Project {
+    // OA is the fixed r2 set; SA independently constructs fresh global IDs.
+    let id = |text| {
+        let id = Id::parse_str(text).unwrap();
+        if layer == Layer::Oa {
+            id
+        } else {
+            Id::from_u128(id.as_u128() ^ (1 << 127))
+        }
+    };
+    let project_id = id("4210b9f2-7046-47f0-aa3b-153f626a579d");
+    let duration = id("188b911c-5f8b-431c-9eea-2d41f3953767");
+    let second = id("534f4672-1ba5-4157-8b0a-b9cf41d0a3ce");
+    let millisecond = id("39053f37-fec9-4708-9f0a-3959d223f891");
+    let combine = id("fd7ce7ab-f789-40bc-b699-0c37f1b6902f");
+    // Parameter IDs may be reused in another calculation/project.
+    let a = ParameterId(Id::parse_str("28ff40b0-1b8f-4735-8536-5a6ab21b56cb").unwrap());
+    let b = ParameterId(Id::parse_str("7a47cc1e-8ae5-4551-b2d8-8a68108e0976").unwrap());
+    let respond = id("cabec6a1-7d5d-48f3-8d2d-a7fc8cf78f59");
+    let receive = id("4ab9a8a7-7552-488d-9862-e14b89e7b353");
+    let dispatch = id("6df991ba-4c5e-4535-99e2-524ae274ee8b");
+    let receive_time = id("63a931c2-675a-4fce-89e5-04361cb99450");
+    let dispatch_time = id("c33fc772-2a60-4044-9af9-73c61c563ace");
+    let total = id("bd5b68e8-65fc-4e35-9071-a73061316a4b");
+    let limit = id("437bedbb-2cf4-44ee-a139-6563cc5086ec");
+    let check = id("bac0de99-9d2f-4e53-9158-d424ecac61bf");
+    let degraded = id("38036c65-16d4-449c-837b-91eb141c1d93");
+    let unmeasured = id("99d3e09a-0ec3-4194-9dd4-9f3de6625cde");
+    let duration_type = || AnalysisType::Scalar(ScalarType::Quantity(local(duration)));
+    let definition = |id, alias: &str, body| Definition {
+        id,
+        alias: alias.into(),
+        name: named(alias),
+        description: String::new(),
+        body,
+    };
+    let shared = |id, alias: &str, body| Element {
+        id,
+        alias: alias.into(),
+        name: named(alias),
+        description: String::new(),
+        parent: None,
+        body: ElementBody::shared_in(layer, body),
+    };
+    let work = |id, alias: &str, parent| Element {
+        id,
+        alias: alias.into(),
+        name: named(alias),
+        description: String::new(),
+        parent,
+        body: if layer == Layer::Oa {
+            ElementBody::Oa(OaBody::Activity)
+        } else {
+            ElementBody::Sa(SaBody::Function)
+        },
+    };
+    let definitions = [
+        definition(
+            duration,
+            "duration",
+            DefinitionBody::QuantityKind(QuantityKindDefinition {
+                dimension: Dimension::new([0, 0, 1, 0, 0, 0, 0]).unwrap(),
+                algebra: QuantityAlgebra::Linear,
+            }),
+        ),
+        definition(
+            second,
+            "second",
+            DefinitionBody::Unit(UnitDefinition {
+                kind: local(duration),
+                scale: Exact::from_integer(1),
+                offset: Exact::from_integer(0),
+                symbol: "s".into(),
+            }),
+        ),
+        definition(
+            millisecond,
+            "millisecond",
+            DefinitionBody::Unit(UnitDefinition {
+                kind: local(duration),
+                scale: Exact::from_wire(
+                    &ExactWire {
+                        numerator: "1".into(),
+                        denominator: "1000".into(),
+                    },
+                    &mut WorkMeter::new(WorkLimits::REFERENCE),
+                )
+                .unwrap(),
+                offset: Exact::from_integer(0),
+                symbol: "ms".into(),
+            }),
+        ),
+        definition(
+            combine,
+            "combine",
+            DefinitionBody::Calculation(CalculationDefinition {
+                parameters: vec![
+                    Parameter {
+                        id: a,
+                        name: "a".into(),
+                        value_type: duration_type(),
+                    },
+                    Parameter {
+                        id: b,
+                        name: "b".into(),
+                        value_type: duration_type(),
+                    },
+                ],
+                result: duration_type(),
+                body: expression(binary(
+                    BinaryOp::Add,
+                    Expr::Parameter(a),
+                    Expr::Parameter(b),
+                )),
+            }),
+        ),
+    ]
+    .into_iter()
+    .map(|definition| (definition.id, definition))
+    .collect();
+    let property = |id, alias, subject, display, base| {
+        shared(
+            id,
+            alias,
+            SharedBody::EngineeringProperty {
+                subject: AnalysisSubject::Element(subject),
+                value_type: duration_type(),
+                display_unit: Some(local(display)),
+                base: expression(base),
+            },
+        )
+    };
+    let case = |id, alias, binding| {
+        shared(
+            id,
+            alias,
+            SharedBody::AnalysisCase {
+                subject: None,
+                base: BaselineBase::ModelBaseline,
+                overrides: BTreeMap::from([(receive_time, binding)]),
+            },
+        )
+    };
+    let elements = [
+        work(respond, "respond", None),
+        work(receive, "receive", Some(respond)),
+        work(dispatch, "dispatch", Some(respond)),
+        property(
+            receive_time,
+            "receive_time",
+            receive,
+            millisecond,
+            quantity(750, millisecond),
+        ),
+        property(
+            dispatch_time,
+            "dispatch_time",
+            dispatch,
+            second,
+            quantity(1, second),
+        ),
+        property(
+            total,
+            "total_time",
+            respond,
+            second,
+            Expr::Call {
+                definition: local(combine),
+                arguments: BTreeMap::from([
+                    (a, Expr::Property(receive_time)),
+                    (b, Expr::Property(dispatch_time)),
+                ]),
+            },
+        ),
+        property(limit, "limit", respond, second, quantity(2, second)),
+        shared(
+            check,
+            "budget",
+            SharedBody::AnalysisCheck {
+                subject: None,
+                documented_constraint: None,
+                predicate: expression(binary(
+                    BinaryOp::LessOrEqual,
+                    Expr::Property(total),
+                    Expr::Property(limit),
+                )),
+            },
+        ),
+        case(
+            degraded,
+            "degraded",
+            expression(quantity(1250, millisecond)),
+        ),
+        case(unmeasured, "unmeasured", Binding::Unbound),
+    ]
+    .into_iter()
+    .map(|element| (element.id, element))
+    .collect();
+    Project {
+        schema_version: 8,
+        id: project_id,
+        alias: "response_budget".into(),
+        name: "Response budget".into(),
+        description: String::new(),
+        definitions,
+        elements,
+        relations: BTreeMap::new(),
+        diagrams: BTreeMap::new(),
+        artifact_links: BTreeMap::new(),
+        traces: BTreeMap::new(),
+    }
+}

crates/oa-core/src/language/analysis_source/syntax.rs

@@ -0,0 +1,432 @@
+//! Iterative Pratt machine. Source nesting does not recurse on the native stack.
+use super::cursor::Cursor;
+use super::*;
+use lex::Class;
+use std::collections::BTreeSet;
+
+enum SequenceKind {
+    List,
+    If,
+    Sum,
+    Unary(UnaryOp),
+    Call(Reference),
+}
+struct Sequence {
+    kind: SequenceKind,
+    start: usize,
+    values: Vec<(Option<Reference>, Expression)>,
+    keys: BTreeSet<String>,
+}
+enum Task {
+    Expression(u8),
+    Continue(u8),
+    Binary(Expression, BinaryOp),
+    Unary(usize, UnaryOp),
+    Group(usize),
+    Next(Sequence),
+    Collected(Sequence, Option<Reference>),
+    Power(usize),
+    AsKind(usize, Reference),
+}
+pub(super) fn binding(p: &mut Cursor<'_, '_>) -> Result<Binding, Error> {
+    p.budget.active()?;
+    if p.text() == "unbound" {
+        let span = p.span();
+        p.cursor += 1;
+        return Ok(Binding::Unbound(span));
+    }
+    let mut tasks = vec![Task::Expression(0)];
+    let mut values = Vec::new();
+    while let Some(task) = tasks.pop() {
+        p.budget.active()?;
+        match task {
+            Task::Expression(minimum) => {
+                let start = p.span().start;
+                if p.text() != "(" {
+                    p.budget.entry(p.span())?;
+                }
+                tasks.push(Task::Continue(minimum));
+                match p.text() {
+                    "true" | "false" => {
+                        let value = p.text() == "true";
+                        let span = p.span();
+                        p.cursor += 1;
+                        values.push(p.node(ExpressionKind::Boolean(value), span)?);
+                    }
+                    "-" => {
+                        p.open()?;
+                        p.cursor += 1;
+                        tasks.push(Task::Unary(start, UnaryOp::Negate));
+                        tasks.push(Task::Expression(7));
+                    }
+                    "(" => {
+                        p.open()?;
+                        p.cursor += 1;
+                        tasks.push(Task::Group(start));
+                        tasks.push(Task::Expression(0));
+                    }
+                    "[" => {
+                        p.open()?;
+                        p.cursor += 1;
+                        tasks.push(Task::Next(Sequence::new(SequenceKind::List, start)));
+                    }
+                    "@" => {
+                        p.cursor += 1;
+                        let reference = p.reference()?;
+                        if p.text() == "(" {
+                            p.open()?;
+                            p.cursor += 1;
+                            tasks.push(Task::Next(Sequence::new(
+                                SequenceKind::Call(reference),
+                                start,
+                            )));
+                        } else {
+                            let end = reference.span.end;
+                            values.push(
+                                p.node(ExpressionKind::Property(reference), Span { start, end })?,
+                            );
+                        }
+                    }
+                    "$" => {
+                        p.cursor += 1;
+                        let reference = p.reference()?;
+                        let end = reference.span.end;
+                        values.push(
+                            p.node(ExpressionKind::Parameter(reference), Span { start, end })?,
+                        );
+                    }
+                    "ratio" => {
+                        let (value, literal) = p.exact_literal()?;
+                        values.push(p.number(value, literal)?);
+                    }
+                    "abs" | "not" | "if" | "sum" => {
+                        let kind = match p.text() {
+                            "abs" => SequenceKind::Unary(UnaryOp::Absolute),
+                            "not" => SequenceKind::Unary(UnaryOp::Not),
+                            "if" => SequenceKind::If,
+                            _ => SequenceKind::Sum,
+                        };
+                        p.cursor += 1;
+                        p.open()?;
+                        p.take("(")?;
+                        tasks.push(Task::Next(Sequence::new(kind, start)));
+                    }
+                    "power" => {
+                        p.cursor += 1;
+                        p.open()?;
+                        p.take("(")?;
+                        tasks.push(Task::Power(start));
+                        tasks.push(Task::Expression(0));
+                    }
+                    "as_kind" => {
+                        p.cursor += 1;
+                        p.open()?;
+                        p.take("(")?;
+                        p.take("@")?;
+                        let kind = p.reference()?;
+                        p.take(",")?;
+                        tasks.push(Task::AsKind(start, kind));
+                        tasks.push(Task::Expression(0));
+                    }
+                    _ if p
+                        .tokens
+                        .get(p.cursor)
+                        .is_some_and(|token| token.class == Class::Number) =>
+                    {
+                        let (value, literal) = p.exact_literal()?;
+                        values.push(p.number(value, literal)?);
+                    }
+                    _ => return Err(error(p.span(), "Expected an analysis expression.")),
+                }
+            }
+            Task::Continue(minimum) => {
+                if let Some((op, precedence)) =
+                    operator(p.text()).filter(|(_, prec)| *prec >= minimum)
+                {
+                    let left = values.pop().expect("completed Pratt operand");
+                    if comparison(op) && ungrouped_comparison(&left) {
+                        return Err(error(p.span(), "Comparison children require parentheses."));
+                    }
+                    p.budget.entry(p.span())?;
+                    p.cursor += 1;
+                    tasks.push(Task::Continue(minimum));
+                    tasks.push(Task::Binary(left, op));
+                    tasks.push(Task::Expression(precedence + 1));
+                }
+            }
+            Task::Binary(left, op) => {
+                let right = values.pop().expect("completed right operand");
+                if comparison(op) && ungrouped_comparison(&right) {
+                    return Err(error(
+                        right.span,
+                        "Comparison children require parentheses.",
+                    ));
+                }
+                let span = Span {
+                    start: left.span.start,
+                    end: right.span.end,
+                };
+                values.push(p.node(
+                    ExpressionKind::Binary {
+                        op,
+                        left: Box::new(left),
+                        right: Box::new(right),
+                    },
+                    span,
+                )?);
+            }
+            Task::Unary(start, op) => {
+                let operand = values.pop().expect("completed unary operand");
+                let end = operand.span.end;
+                p.close();
+                values.push(p.node(
+                    ExpressionKind::Unary {
+                        op,
+                        operand: Box::new(operand),
+                    },
+                    Span { start, end },
+                )?);
+            }
+            Task::Group(start) => {
+                let end = p.take(")")?.end;
+                p.close();
+                let value = values.last_mut().expect("completed grouped expression");
+                value.grouped = true;
+                value.span = Span { start, end };
+            }
+            Task::Next(mut sequence) => {
+                let closing = if matches!(sequence.kind, SequenceKind::List) {
+                    "]"
+                } else {
+                    ")"
+                };
+                if p.text() == closing {
+                    let end = p.take(closing)?.end;
+                    p.close();
+                    values.push(p.sequence(sequence, end)?);
+                } else {
+                    let count = sequence.values.len();
+                    let maximum = match sequence.kind {
+                        SequenceKind::List => crate::analysis::MAX_LIST_LENGTH,
+                        SequenceKind::Unary(_) => 1,
+                        SequenceKind::If => 3,
+                        SequenceKind::Sum => 2,
+                        SequenceKind::Call(_) => usize::MAX,
+                    };
+                    if count >= maximum {
+                        return Err(error(
+                            p.span(),
+                            "Too many list members or constructor arguments.",
+                        ));
+                    }
+                    let key = if matches!(sequence.kind, SequenceKind::Call(_)) {
+                        p.budget.entry(p.span())?;
+                        let key = p.reference()?;
+                        if !sequence.keys.insert(key.name.clone()) {
+                            return Err(error(key.span, "Duplicate call argument name."));
+                        }
+                        p.take(":")?;
+                        Some(key)
+                    } else {
+                        None
+                    };
+                    tasks.push(Task::Collected(sequence, key));
+                    tasks.push(Task::Expression(0));
+                }
+            }
+            Task::Collected(mut sequence, key) => {
+                sequence
+                    .values
+                    .push((key, values.pop().expect("completed sequence value")));
+                let closing = if matches!(sequence.kind, SequenceKind::List) {
+                    "]"
+                } else {
+                    ")"
+                };
+                if p.text() != closing {
+                    p.take(",")?;
+                    if p.text() == closing {
+                        return Err(error(p.span(), "Trailing comma is not an expression."));
+                    }
+                }
+                tasks.push(Task::Next(sequence));
+            }
+            Task::Power(start) => {
+                let base = values.pop().expect("completed power base");
+                p.take(",")?;
+                let negative = if p.text() == "-" {
+                    p.cursor += 1;
+                    true
+                } else {
+                    false
+                };
+                let span = p.integer()?;
+                let magnitude = p.source[span.start..span.end]
+                    .parse::<u8>()
+                    .map_err(|_| error(span, "Power exponent is outside -16..16."))?;
+                if magnitude > 16 {
+                    return Err(error(span, "Power exponent is outside -16..16."));
+                }
+                let exponent = if negative {
+                    -(magnitude as i8)
+                } else {
+                    magnitude as i8
+                };
+                let end = p.take(")")?.end;
+                p.close();
+                values.push(p.node(
+                    ExpressionKind::Power {
+                        base: Box::new(base),
+                        exponent,
+                    },
+                    Span { start, end },
+                )?);
+            }
+            Task::AsKind(start, kind) => {
+                let value = values.pop().expect("completed kind assertion value");
+                let end = p.take(")")?.end;
+                p.close();
+                values.push(p.node(
+                    ExpressionKind::AsKind {
+                        kind,
+                        value: Box::new(value),
+                    },
+                    Span { start, end },
+                )?);
+            }
+        }
+    }
+    Ok(Binding::Expression(
+        values.pop().expect("one complete expression"),
+    ))
+}
+impl Sequence {
+    fn new(kind: SequenceKind, start: usize) -> Self {
+        Self {
+            kind,
+            start,
+            values: Vec::new(),
+            keys: BTreeSet::new(),
+        }
+    }
+}
+impl Cursor<'_, '_> {
+    fn number(&mut self, magnitude: Exact, literal: LiteralSyntax) -> Result<Expression, Error> {
+        let Span { start, end } = literal.span;
+        let mut expression = if self.text() == "[" {
+            self.open()?;
+            self.cursor += 1;
+            self.take("@")?;
+            let unit = self.reference()?;
+            let end = self.take("]")?.end;
+            self.close();
+            self.node(
+                ExpressionKind::Quantity { magnitude, unit },
+                Span { start, end },
+            )
+        } else {
+            self.node(ExpressionKind::Number(magnitude), Span { start, end })
+        }?;
+        expression.literal = Some(literal);
+        Ok(expression)
+    }
+    fn node(&mut self, kind: ExpressionKind, span: Span) -> Result<Expression, Error> {
+        let child_depth = match &kind {
+            ExpressionKind::Unary { operand, .. } => operand.depth,
+            ExpressionKind::Binary { left, right, .. } => left.depth.max(right.depth),
+            ExpressionKind::If {
+                condition,
+                when_true,
+                when_false,
+            } => condition.depth.max(when_true.depth).max(when_false.depth),
+            ExpressionKind::List(values) => values.iter().map(|v| v.depth).max().unwrap_or(0),
+            ExpressionKind::Call { arguments, .. } => {
+                arguments.iter().map(|a| a.value.depth).max().unwrap_or(0)
+            }
+            ExpressionKind::Sum { values, initial } => values.depth.max(initial.depth),
+            ExpressionKind::Power { base, .. } => base.depth,
+            ExpressionKind::AsKind { value, .. } => value.depth,
+            _ => 0,
+        };
+        if child_depth >= crate::analysis::MAX_EXPRESSION_DEPTH {
+            return Err(error(span, "Expression logical depth exceeds 128."));
+        }
+        Ok(Expression {
+            kind,
+            span,
+            depth: child_depth + 1,
+            grouped: false,
+            literal: None,
+        })
+    }
+    fn sequence(&mut self, sequence: Sequence, end: usize) -> Result<Expression, Error> {
+        let span = Span {
+            start: sequence.start,
+            end,
+        };
+        let mut values = sequence.values.into_iter();
+        let mut next = || {
+            values
+                .next()
+                .map(|(_, value)| Box::new(value))
+                .ok_or_else(|| error(span, "Missing required constructor argument."))
+        };
+        let kind = match sequence.kind {
+            SequenceKind::If => ExpressionKind::If {
+                condition: next()?,
+                when_true: next()?,
+                when_false: next()?,
+            },
+            SequenceKind::Sum => ExpressionKind::Sum {
+                values: next()?,
+                initial: next()?,
+            },
+            SequenceKind::Unary(op) => ExpressionKind::Unary {
+                op,
+                operand: next()?,
+            },
+            SequenceKind::List => ExpressionKind::List(values.map(|(_, value)| value).collect()),
+            SequenceKind::Call(definition) => ExpressionKind::Call {
+                definition,
+                arguments: values
+                    .map(|(parameter, value)| Argument {
+                        parameter: parameter.expect("parsed named argument"),
+                        value,
+                    })
+                    .collect(),
+            },
+        };
+        self.node(kind, span)
+    }
+}
+fn comparison(op: BinaryOp) -> bool {
+    matches!(
+        op,
+        BinaryOp::Equal
+            | BinaryOp::NotEqual
+            | BinaryOp::Less
+            | BinaryOp::LessOrEqual
+            | BinaryOp::Greater
+            | BinaryOp::GreaterOrEqual
+    )
+}
+fn ungrouped_comparison(value: &Expression) -> bool {
+    !value.grouped && matches!(&value.kind, ExpressionKind::Binary { op, .. } if comparison(*op))
+}
+fn operator(text: &str) -> Option<(BinaryOp, u8)> {
+    Some(match text {
+        "or" => (BinaryOp::Or, 1),
+        "and" => (BinaryOp::And, 2),
+        "==" => (BinaryOp::Equal, 3),
+        "!=" => (BinaryOp::NotEqual, 3),
+        "<" => (BinaryOp::Less, 4),
+        "<=" => (BinaryOp::LessOrEqual, 4),
+        ">" => (BinaryOp::Greater, 4),
+        ">=" => (BinaryOp::GreaterOrEqual, 4),
+        "+" => (BinaryOp::Add, 5),
+        "-" => (BinaryOp::Subtract, 5),
+        "*" => (BinaryOp::Multiply, 6),
+        "/" => (BinaryOp::Divide, 6),
+        _ => return None,
+    })
+}

crates/oa-core/src/language/analysis_source/tests.rs

@@ -0,0 +1,503 @@
+use super::*;
+use crate::language::ParseLimits;
+use budget::{Budget, Limits};
+
+fn limits() -> Limits {
+    Limits::source8(ParseLimits::UNLIMITED)
+}
+fn budget() -> Budget {
+    Budget::new(limits()).unwrap()
+}
+fn expression(source: &str) -> Expression {
+    match parse(source, &mut budget()).unwrap() {
+        Binding::Expression(value) => value,
+        Binding::Unbound(_) => panic!("expected expression"),
+    }
+}
+fn number(value: &Expression) -> String {
+    let ExpressionKind::Number(exact) = &value.kind else {
+        panic!("expected Number");
+    };
+    exact.canonical_literal()
+}
+
+fn binary_children(value: Expression, expected: BinaryOp) -> (Expression, Expression) {
+    let ExpressionKind::Binary { op, left, right } = value.kind else {
+        panic!("expected Binary {expected:?}");
+    };
+    assert_eq!(op, expected);
+    (*left, *right)
+}
+
+#[test]
+fn mixed_precedence_and_grouping_have_independent_expected_child_topology() {
+    let (one, product) = binary_children(expression("1 + 2 * 3"), BinaryOp::Add);
+    assert_eq!(number(&one), "1");
+    let (two, three) = binary_children(product, BinaryOp::Multiply);
+    assert_eq!(
+        (number(&two), number(&three)),
+        ("2".to_owned(), "3".to_owned())
+    );
+
+    let (conjunction, last) =
+        binary_children(expression("not(false) and true or false"), BinaryOp::Or);
+    assert_eq!(last.kind, ExpressionKind::Boolean(false));
+    let (negated, middle) = binary_children(conjunction, BinaryOp::And);
+    assert_eq!(middle.kind, ExpressionKind::Boolean(true));
+    let ExpressionKind::Unary { op, operand } = negated.kind else {
+        panic!("expected Not");
+    };
+    assert_eq!(op, UnaryOp::Not);
+    assert_eq!(operand.kind, ExpressionKind::Boolean(false));
+
+    let (negative, two) = binary_children(expression("-1 * 2"), BinaryOp::Multiply);
+    assert_eq!(number(&two), "2");
+    let ExpressionKind::Unary { op, operand } = negative.kind else {
+        panic!("expected Negate");
+    };
+    assert_eq!(op, UnaryOp::Negate);
+    assert_eq!(number(&operand), "1");
+
+    let (quotient, three) = binary_children(expression("1 / 2 * 3"), BinaryOp::Multiply);
+    assert_eq!(number(&three), "3");
+    let (one, two) = binary_children(quotient, BinaryOp::Divide);
+    assert_eq!(
+        (number(&one), number(&two)),
+        ("1".to_owned(), "2".to_owned())
+    );
+
+    let (one, grouped) = binary_children(expression("1 + (2 + 3)"), BinaryOp::Add);
+    assert_eq!(number(&one), "1");
+    assert!(grouped.grouped);
+    let (two, three) = binary_children(grouped, BinaryOp::Add);
+    assert_eq!(
+        (number(&two), number(&three)),
+        ("2".to_owned(), "3".to_owned())
+    );
+}
+
+#[test]
+fn flat_binary_depth_and_malformed_constructor_retain_bounded_completed_children() {
+    let flat = |count: usize| vec!["true"; count].join(" and ");
+    let deep = flat(128);
+    let mut tree = expression(&deep);
+    assert_eq!(tree.depth, 128);
+    // Independently verify the complete left-associated shape, not just depth.
+    for _ in 1..128 {
+        let (left, right) = binary_children(tree, BinaryOp::And);
+        assert_eq!(right.kind, ExpressionKind::Boolean(true));
+        tree = left;
+    }
+    assert_eq!(tree.kind, ExpressionKind::Boolean(true));
+    assert!(
+        parse(&flat(129), &mut budget())
+            .unwrap_err()
+            .message
+            .contains("logical depth")
+    );
+
+    // The first argument is already a complete depth128 tree when parsing the
+    // second fails. Refusal tears down the held child without building Sum.
+    let malformed = format!("sum({deep}, @)");
+    let failure = parse(&malformed, &mut budget()).unwrap_err();
+    assert_eq!(
+        failure.message,
+        "Expected a valid reference or parameter name."
+    );
+    assert_eq!(&malformed[failure.span.start..failure.span.end], ")");
+    assert_eq!(number(&expression("1")), "1");
+}
+
+#[test]
+fn significant_ratio_and_quantity_trivia_preserve_original_spans() {
+    let source = "ratio // explanation café\n ( - // sign\n 3, // denominator\n 4 ) // measurement\n [@millisecond]";
+    let parsed = expression(source);
+    assert_eq!(
+        parsed.span,
+        Span {
+            start: 0,
+            end: source.len()
+        }
+    );
+    let literal = parsed.literal.as_ref().unwrap();
+    assert!(source[literal.span.start..literal.span.end].contains("// denominator"));
+    assert_eq!(
+        literal
+            .tokens
+            .iter()
+            .map(|span| &source[span.start..span.end])
+            .collect::<Vec<_>>(),
+        ["ratio", "(", "-", "3", ",", "4", ")"]
+    );
+    let ExpressionKind::Quantity { magnitude, unit } = parsed.kind else {
+        panic!("expected Quantity");
+    };
+    assert_eq!(magnitude.canonical_literal(), "ratio(-3, 4)");
+    assert_eq!(unit.name, "millisecond");
+    assert_eq!(&source[unit.span.start..unit.span.end], "millisecond");
+    let mut renamed = source.to_owned();
+    renamed.replace_range(unit.span.start..unit.span.end, "ms");
+    assert_eq!(renamed, source.replacen("millisecond", "ms", 1));
+    assert_eq!(
+        number(&expression("ratio (1, // rationale\n 2)")),
+        "ratio(1, 2)"
+    );
+    for invalid in [
+        "1 e - 2",
+        "1e // x\n -2",
+        "1 . 2",
+        "ratio(1 + 2, 3)",
+        "ratio(1, -2)",
+        "ratio(+1, 2)",
+        "ratio(1.0, 2)",
+        "ratio(1, 0)",
+    ] {
+        assert!(parse(invalid, &mut budget()).is_err(), "{invalid}");
+    }
+}
+
+#[test]
+fn raw_numeric_lexing_preserves_exact_atoms_and_operator_boundaries() {
+    let source = "1-2 1e-2 ratio(-1,2) -(1) <= >= == !=";
+    let tokens = lex::tokens(source, &mut budget()).unwrap();
+    let text: Vec<_> = tokens
+        .iter()
+        .map(|t| &source[t.span.start..t.span.end])
+        .collect();
+    assert_eq!(
+        text,
+        [
+            "1", "-", "2", "1e-2", "ratio", "(", "-", "1", ",", "2", ")", "-", "(", "1", ")", "<=",
+            ">=", "==", "!="
+        ]
+    );
+    let huge = "9".repeat(400);
+    assert_eq!(
+        lex::tokens(&huge, &mut budget()).unwrap()[0].class,
+        lex::Class::Number
+    );
+    assert_eq!(number(&expression(&huge)), huge);
+    for invalid in ["1e", "1e+", "1_0", "0x1", "1.2.3"] {
+        assert!(lex::tokens(invalid, &mut budget()).is_err(), "{invalid}");
+    }
+    let quoted = "\"quoted\\\" café\"";
+    let tokens = lex::tokens(quoted, &mut budget()).unwrap();
+    assert_eq!(tokens[0].class, lex::Class::String);
+    assert_eq!(&quoted[tokens[0].span.start..tokens[0].span.end], quoted);
+}
+
+#[test]
+fn unary_literals_precedence_and_comparison_children_keep_distinct_trees() {
+    assert_eq!(number(&expression("ratio(-1, 1)")), "ratio(-1, 1)");
+    let negative = expression("-(1)");
+    assert!(matches!(
+        negative.kind,
+        ExpressionKind::Unary {
+            op: UnaryOp::Negate,
+            ..
+        }
+    ));
+    let left = expression("(1 - 2) - 3");
+    let right = expression("1 - (2 - 3)");
+    let ExpressionKind::Binary {
+        left, right: last, ..
+    } = left.kind
+    else {
+        panic!();
+    };
+    assert!(matches!(
+        left.kind,
+        ExpressionKind::Binary {
+            op: BinaryOp::Subtract,
+            ..
+        }
+    ));
+    assert_eq!(number(&last), "3");
+    let ExpressionKind::Binary {
+        left: first, right, ..
+    } = right.kind
+    else {
+        panic!();
+    };
+    assert_eq!(number(&first), "1");
+    assert!(matches!(
+        right.kind,
+        ExpressionKind::Binary {
+            op: BinaryOp::Subtract,
+            ..
+        }
+    ));
+    for valid in [
+        "(1 < 2) == true",
+        "(true == false) == true",
+        "true == (1 < 2)",
+        "1 + 2 * 3",
+        "not(false) and true or false",
+    ] {
+        parse(valid, &mut budget()).unwrap();
+    }
+    for invalid in [
+        "1 < 2 == true",
+        "true == false == true",
+        "1 < 2 < 3",
+        "true == 1 < 2",
+    ] {
+        assert!(parse(invalid, &mut budget()).is_err(), "{invalid}");
+    }
+}
+
+#[test]
+fn every_expression_shape_and_exact_constructor_arity_is_represented() {
+    let tree = expression("if(true, sum([@p, $x], 0), as_kind(@duration, power(abs(-(2)), -2)))");
+    let ExpressionKind::If {
+        condition,
+        when_true,
+        when_false,
+    } = tree.kind
+    else {
+        panic!();
+    };
+    assert_eq!(condition.kind, ExpressionKind::Boolean(true));
+    let ExpressionKind::Sum { values, initial } = when_true.kind else {
+        panic!();
+    };
+    assert_eq!(number(&initial), "0");
+    let ExpressionKind::List(values) = values.kind else {
+        panic!();
+    };
+    assert!(matches!(&values[0].kind, ExpressionKind::Property(r) if r.name == "p"));
+    assert!(matches!(&values[1].kind, ExpressionKind::Parameter(r) if r.name == "x"));
+    let ExpressionKind::AsKind { kind, value } = when_false.kind else {
+        panic!();
+    };
+    assert_eq!(kind.name, "duration");
+    assert!(matches!(
+        value.kind,
+        ExpressionKind::Power { exponent: -2, .. }
+    ));
+    assert!(matches!(expression("[]").kind, ExpressionKind::List(v) if v.is_empty()));
+    assert!(
+        matches!(expression("@zero()").kind, ExpressionKind::Call { arguments, .. } if arguments.is_empty())
+    );
+    assert!(matches!(
+        parse(" unbound // pending", &mut budget()).unwrap(),
+        Binding::Unbound(_)
+    ));
+    for invalid in [
+        "sum([1])",
+        "sum([1], 0, 2)",
+        "if(true, 1)",
+        "abs()",
+        "not(true, false)",
+        "power(2, 17)",
+        "power(2, 1.0)",
+        "as_kind(duration, 1)",
+        "[1,]",
+        "[1 2]",
+        "(1+2)[@unit]",
+    ] {
+        assert!(parse(invalid, &mut budget()).is_err(), "{invalid}");
+    }
+}
+
+#[test]
+fn repeated_call_argument_occurrences_have_distinct_original_spans() {
+    let source = "@combine(a: @p, b: 2) + @combine(a: @q, b: 4)";
+    let tree = expression(source);
+    let ExpressionKind::Binary { left, right, .. } = tree.kind else {
+        panic!();
+    };
+    let ExpressionKind::Call {
+        definition: first,
+        arguments: a,
+    } = left.kind
+    else {
+        panic!();
+    };
+    let ExpressionKind::Call {
+        definition: second,
+        arguments: b,
+    } = right.kind
+    else {
+        panic!();
+    };
+    assert_eq!(first.name, second.name);
+    assert_ne!(first.span, second.span);
+    assert_eq!(a[0].parameter.name, b[0].parameter.name);
+    assert_ne!(a[0].parameter.span, b[0].parameter.span);
+    for argument in a.iter().chain(&b) {
+        assert_eq!(
+            &source[argument.parameter.span.start..argument.parameter.span.end],
+            argument.parameter.name
+        );
+    }
+    assert!(
+        parse("@combine(a: 1, a: 2)", &mut budget())
+            .unwrap_err()
+            .message
+            .contains("Duplicate")
+    );
+    assert!(parse("@combine(a: 1, b:)", &mut budget()).is_err());
+    // Resolution to owner-qualified ParameterId and actual source rewrites are
+    // deliberately a later stage; this oracle establishes unique syntax spans.
+}
+
+#[test]
+fn budgets_aggregate_across_fragments_and_latch_numeric_exhaustion() {
+    let mut first = budget();
+    parse("ratio(1, 3)", &mut first).unwrap();
+    let cost = first.numeric_units();
+    assert!(cost > 0);
+    let mut settings = limits();
+    settings.numeric_units = cost;
+    let mut shared = Budget::new(settings).unwrap();
+    parse("ratio (1, // same numeric cost\n 3)", &mut shared).unwrap();
+    assert_eq!(shared.numeric_units(), cost);
+    let failure = parse("2", &mut shared).unwrap_err();
+    let usage = shared.usage;
+    assert_eq!(parse("unbound", &mut shared).unwrap_err(), failure);
+    assert_eq!(shared.usage, usage);
+    parse("2", &mut budget()).unwrap();
+
+    let mut settings = limits();
+    settings.entries = 2;
+    let mut shared = Budget::new(settings).unwrap();
+    parse("true", &mut shared).unwrap();
+    parse("false", &mut shared).unwrap();
+    assert!(
+        parse("true", &mut shared)
+            .unwrap_err()
+            .message
+            .contains("entries")
+    );
+    assert_eq!(shared.usage.entries, 2);
+    let mut settings = limits();
+    settings.references = 1;
+    let mut shared = Budget::new(settings).unwrap();
+    parse("@one", &mut shared).unwrap();
+    assert!(
+        parse("$two", &mut shared)
+            .unwrap_err()
+            .message
+            .contains("references")
+    );
+    assert_eq!(shared.usage.references, 1);
+}
+
+#[test]
+fn byte_token_frame_logical_and_list_boundaries_have_nearby_successes() {
+    let mut settings = limits();
+    settings.bytes = 4;
+    let mut shared = Budget::new(settings).unwrap();
+    parse("true", &mut shared).unwrap();
+    assert!(
+        parse(" ", &mut shared)
+            .unwrap_err()
+            .message
+            .contains("bytes")
+    );
+    assert_eq!(shared.usage.bytes, 4);
+    let mut settings = limits();
+    settings.tokens = 2;
+    let mut shared = Budget::new(settings).unwrap();
+    parse("true ", &mut shared).unwrap();
+    assert!(
+        parse("// note", &mut shared)
+            .unwrap_err()
+            .message
+            .contains("tokens")
+    );
+    assert_eq!(shared.usage.tokens, 2);
+    let nested = |depth: usize| format!("{}true{}", "(".repeat(depth), ")".repeat(depth));
+    let mut shared = budget();
+    assert_eq!(
+        match parse(&nested(256), &mut shared).unwrap() {
+            Binding::Expression(e) => e.depth,
+            _ => 0,
+        },
+        1
+    );
+    assert_eq!(shared.usage.deepest_frame, 256);
+    assert!(
+        parse(&nested(257), &mut budget())
+            .unwrap_err()
+            .message
+            .contains("frames")
+    );
+    let unary = |depth: usize| format!("{}true{}", "not(".repeat(depth - 1), ")".repeat(depth - 1));
+    assert_eq!(expression(&unary(128)).depth, 128);
+    assert!(
+        parse(&unary(129), &mut budget())
+            .unwrap_err()
+            .message
+            .contains("logical depth")
+    );
+    let list = |count: usize| format!("[{}]", vec!["true"; count].join(","));
+    parse(&list(1024), &mut budget()).unwrap();
+    assert!(parse(&list(1025), &mut budget()).is_err());
+    let lowered = Limits::source8(ParseLimits {
+        max_source_bytes: 8,
+        max_graph_objects: 3,
+        max_records: 5,
+        max_step_references: 2,
+    });
+    assert_eq!(
+        (
+            lowered.bytes,
+            lowered.tokens,
+            lowered.entries,
+            lowered.references
+        ),
+        (8, 8, 5, 2)
+    );
+    let mut above = limits();
+    above.frames += 1;
+    assert!(Budget::new(above).is_err());
+}
+
+#[test]
+fn partial_wide_and_deep_input_cleanup_does_not_poison_a_fresh_parse() {
+    let source = "@f(a: if(true, [ratio (1, //why\n 2), @p], sum([1, 2], 0)), b: power(2, -3))";
+    let tokens = lex::tokens(source, &mut budget()).unwrap();
+    for token in tokens.iter().filter(|token| {
+        matches!(
+            &source[token.span.start..token.span.end],
+            "(" | "[" | "," | ":" | "@"
+        )
+    }) {
+        assert!(parse(&source[..token.span.end], &mut budget()).is_err());
+        assert_eq!(number(&expression("ratio(2, 3)")), "ratio(2, 3)");
+    }
+    for malformed in [
+        format!("{}true", "(".repeat(256)),
+        format!("[{}", vec!["true"; 1024].join(",")),
+        "-".repeat(10_000),
+    ] {
+        assert!(parse(&malformed, &mut budget()).is_err());
+        parse("true", &mut budget()).unwrap();
+    }
+}
+
+#[test]
+fn public_source_headers_and_existing_numeric_token_controls_are_unchanged() {
+    assert!(crate::language::parse("arcadia 8; project p \"P\" {}").is_err());
+    for accepted in ["-1.5", "1e-2", "0", "-0"] {
+        let tokens = crate::language::tokenize(accepted);
+        assert_eq!(tokens.len(), 1);
+        assert_eq!(tokens[0].class, crate::language::TokenClass::Number);
+        assert_eq!(
+            tokens[0].span,
+            Span {
+                start: 0,
+                end: accepted.len()
+            }
+        );
+    }
+    for rejected in ["+1", "1_0", "0x1", "1e"] {
+        assert!(
+            crate::language::tokenize(rejected)
+                .iter()
+                .any(|t| t.class == crate::language::TokenClass::Error)
+        );
+    }
+}

crates/oa-core/src/language/analysis_source/write.rs

@@ -0,0 +1,664 @@
+//! Private typed canonical output. Complete semantic admission belongs to the
+//! caller. No public formatter, version dispatch or source edits use this yet.
+mod expression;
+pub(super) use expression::{Parent, Side};
+
+use super::{budget, lower::Field};
+use crate::analysis as a;
+use crate::analysis_numeric::Exact;
+use crate::{Id, Kind, Layer, Project, SharedBody};
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::Write;
+
+#[derive(Clone, Copy)]
+pub(super) struct Limits {
+    pub bytes: usize,
+    pub entries: usize,
+}
+impl Limits {
+    pub fn source8(caller: crate::language::ParseLimits) -> Self {
+        let limits = budget::Limits::source8(caller);
+        Self {
+            bytes: limits.bytes,
+            entries: limits.entries,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct Error {
+    pub owner: Option<Id>,
+    pub field: &'static str,
+    pub message: String,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(super) struct Usage {
+    pub bytes: usize,
+    pub entries: usize,
+}
+
+struct Sink {
+    buffer: Vec<u8>,
+    written: usize,
+    maximum: usize,
+}
+impl Sink {
+    fn room(&self, bytes: usize) -> std::io::Result<()> {
+        if bytes > self.maximum.saturating_sub(self.written) {
+            return Err(std::io::Error::other(
+                "Source8 writer output byte limit exceeded.",
+            ));
+        }
+        Ok(())
+    }
+}
+impl Write for Sink {
+    fn write(&mut self, bytes: &[u8]) -> std::io::Result<usize> {
+        self.room(bytes.len())?;
+        self.buffer.extend_from_slice(bytes);
+        self.written += bytes.len();
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+pub(super) struct Writer<'p> {
+    project: &'p Project,
+    parameters: BTreeMap<Id, BTreeMap<a::ParameterId, &'p a::Parameter>>,
+    limits: Limits,
+    entries: usize,
+    sink: Sink,
+    owner: Option<Id>,
+    field: &'static str,
+    failed: Option<Error>,
+}
+
+impl<'p> Writer<'p> {
+    pub fn new(project: &'p Project, limits: Limits) -> Result<Self, Error> {
+        let hard = Limits::source8(crate::language::ParseLimits::UNLIMITED);
+        if limits.bytes > hard.bytes || limits.entries > hard.entries {
+            return Err(Error {
+                owner: None,
+                field: "writer",
+                message: "Writer limits exceed the source8 profile.".into(),
+            });
+        }
+        let mut writer = Self {
+            project,
+            parameters: BTreeMap::new(),
+            limits,
+            entries: 0,
+            sink: Sink {
+                buffer: Vec::new(),
+                written: 0,
+                maximum: limits.bytes,
+            },
+            owner: None,
+            field: "writer",
+            failed: None,
+        };
+        for definition in project.definitions.values() {
+            writer.owner = Some(definition.id);
+            writer.field = "parameters";
+            writer.entry()?;
+            if let a::DefinitionBody::Calculation(calculation) = &definition.body {
+                let mut parameters = BTreeMap::new();
+                let mut names = BTreeSet::new();
+                for parameter in &calculation.parameters {
+                    writer.entry()?;
+                    if parameters.contains_key(&parameter.id)
+                        || !names.insert(parameter.name.as_str())
+                    {
+                        return Err(writer.error("Duplicate scoped parameter identity or name."));
+                    }
+                    parameters.insert(parameter.id, parameter);
+                }
+                writer.parameters.insert(definition.id, parameters);
+            }
+        }
+        Ok(writer)
+    }
+
+    pub fn usage(&self) -> Usage {
+        Usage {
+            bytes: self.sink.written,
+            entries: self.entries,
+        }
+    }
+
+    fn error(&self, message: impl Into<String>) -> Error {
+        Error {
+            owner: self.owner,
+            field: self.field,
+            message: message.into(),
+        }
+    }
+    fn entry(&mut self) -> Result<(), Error> {
+        if self.entries == self.limits.entries {
+            return Err(self.error("Source8 writer entry limit exceeded."));
+        }
+        self.entries += 1;
+        Ok(())
+    }
+    fn pending(&self, count: usize) -> Result<(), Error> {
+        if count > self.limits.entries {
+            return Err(self.error("Source8 writer pending work limit exceeded."));
+        }
+        Ok(())
+    }
+    fn text(&mut self, text: &str) -> Result<(), Error> {
+        self.sink
+            .write_all(text.as_bytes())
+            .map_err(|cause| self.error(cause.to_string()))
+    }
+    fn quote(&mut self, text: &str) -> Result<(), Error> {
+        // Identical serde_json string escaping to language::quote, streamed
+        // directly to the checked sink instead of an unbounded scratch String.
+        self.sink
+            .room(text.len().saturating_add(2))
+            .map_err(|cause| self.error(cause.to_string()))?;
+        serde_json::to_writer(&mut self.sink, text).map_err(|cause| self.error(cause.to_string()))
+    }
+    fn name(&mut self, name: &str) -> Result<(), Error> {
+        self.sink
+            .room(name.len())
+            .map_err(|cause| self.error(cause.to_string()))?;
+        if !crate::valid_alias(name) {
+            return Err(self.error("Invalid alias or parameter name."));
+        }
+        self.text(name)
+    }
+    fn exact(&mut self, exact: &Exact) -> Result<(), Error> {
+        // At most two already-bounded 4096-bit components, never an Expr-sized
+        // temporary or a second parse/normalization of the stored value.
+        self.text(&exact.canonical_literal())
+    }
+    fn run(
+        &mut self,
+        owner: Id,
+        field: &'static str,
+        emit: impl FnOnce(&mut Self) -> Result<(), Error>,
+    ) -> Result<String, Error> {
+        if let Some(error) = &self.failed {
+            return Err(error.clone());
+        }
+        self.owner = Some(owner);
+        self.field = field;
+        debug_assert!(self.sink.buffer.is_empty());
+        if let Err(error) = emit(self) {
+            self.sink.buffer.clear();
+            self.failed = Some(error.clone());
+            return Err(error);
+        }
+        Ok(String::from_utf8(std::mem::take(&mut self.sink.buffer))
+            .expect("text and JSON string writes are UTF-8"))
+    }
+
+    fn definition_name(
+        &self,
+        reference: a::DefinitionRef,
+        kind: DefinitionKind,
+    ) -> Result<&'p str, Error> {
+        let definition = self
+            .project
+            .definitions
+            .get(&reference.local())
+            .ok_or_else(|| self.error("Unknown definition reference."))?;
+        let matches = matches!(
+            (&definition.body, kind),
+            (
+                a::DefinitionBody::QuantityKind(_),
+                DefinitionKind::QuantityKind
+            ) | (a::DefinitionBody::Unit(_), DefinitionKind::Unit)
+                | (
+                    a::DefinitionBody::Calculation(_),
+                    DefinitionKind::Calculation
+                )
+        );
+        if !matches {
+            return Err(self.error("Wrong definition reference domain."));
+        }
+        Ok(&definition.alias)
+    }
+    fn definition_ref(
+        &mut self,
+        reference: a::DefinitionRef,
+        kind: DefinitionKind,
+    ) -> Result<(), Error> {
+        let alias = self.definition_name(reference, kind)?;
+        self.text("@")?;
+        self.name(alias)
+    }
+    fn property_name(&self, id: Id) -> Result<&'p str, Error> {
+        self.project
+            .elements
+            .get(&id)
+            .filter(|value| value.kind() == Kind::EngineeringProperty)
+            .map(|value| value.alias.as_str())
+            .ok_or_else(|| self.error("Unknown property reference or wrong reference domain."))
+    }
+    fn subject(&mut self, subject: a::AnalysisSubject) -> Result<(), Error> {
+        let alias = match subject {
+            a::AnalysisSubject::Element(id) => self
+                .project
+                .elements
+                .get(&id)
+                .filter(|value| !value.kind().is_analysis())
+                .map(|value| value.alias.as_str()),
+            a::AnalysisSubject::Relation(id) => self
+                .project
+                .relations
+                .get(&id)
+                .map(|value| value.alias.as_str()),
+        }
+        .ok_or_else(|| self.error("Unknown architectural subject or wrong reference domain."))?;
+        self.text("@")?;
+        self.name(alias)
+    }
+    fn optional_subject(&mut self, subject: Option<a::AnalysisSubject>) -> Result<(), Error> {
+        if let Some(subject) = subject {
+            self.subject(subject)
+        } else {
+            self.text("none")
+        }
+    }
+    fn type_value(&mut self, value: &a::AnalysisType) -> Result<(), Error> {
+        self.entry()?;
+        let (scalar, list) = match value {
+            a::AnalysisType::Scalar(value) => (value, false),
+            a::AnalysisType::List(value) => (value, true),
+        };
+        if list {
+            self.text("List(")?;
+        }
+        match scalar {
+            a::ScalarType::Boolean => self.text("Boolean")?,
+            a::ScalarType::Number => self.text("Number")?,
+            a::ScalarType::Quantity(kind) => {
+                self.text("Quantity(")?;
+                self.definition_ref(*kind, DefinitionKind::QuantityKind)?;
+                self.text(")")?;
+            }
+        }
+        if list {
+            self.text(")")?;
+        }
+        Ok(())
+    }
+    pub fn value_type(&mut self, owner: Id, value: &a::AnalysisType) -> Result<String, Error> {
+        self.run(owner, "type", |writer| writer.type_value(value))
+    }
+    fn model_binding(
+        &self,
+        owner: Id,
+        field: Field,
+    ) -> Result<(&'p a::Binding, Option<Id>), Error> {
+        if field == Field::Body {
+            if let Some(a::Definition {
+                body: a::DefinitionBody::Calculation(calculation),
+                ..
+            }) = self.project.definitions.get(&owner)
+            {
+                return Ok((&calculation.body, Some(owner)));
+            }
+        } else if let Some(element) = self.project.elements.get(&owner) {
+            match (element.shared(), field) {
+                (Some(SharedBody::EngineeringProperty { base, .. }), Field::Base) => {
+                    return Ok((base, None));
+                }
+                (Some(SharedBody::AnalysisCheck { predicate, .. }), Field::Predicate) => {
+                    return Ok((predicate, None));
+                }
+                (Some(SharedBody::AnalysisCase { overrides, .. }), Field::Override(property)) => {
+                    return overrides
+                        .get(&property)
+                        .map(|binding| (binding, None))
+                        .ok_or_else(|| self.error("Missing override binding."));
+                }
+                _ => {}
+            }
+        }
+        Err(self.error("Binding field does not belong to the requested owner."))
+    }
+    fn binding_value(
+        &mut self,
+        binding: &a::Binding,
+        calculation: Option<Id>,
+    ) -> Result<(), Error> {
+        match binding {
+            a::Binding::Unbound => {
+                self.entry()?;
+                self.text("unbound")
+            }
+            a::Binding::Expression(expression) => {
+                self.emit_expression(expression, calculation, Parent::Root)
+            }
+        }
+    }
+    pub fn binding(&mut self, owner: Id, field: Field) -> Result<String, Error> {
+        self.run(owner, binding_field(field), |writer| {
+            let (binding, scope) = writer.model_binding(owner, field)?;
+            writer.binding_value(binding, scope)
+        })
+    }
+    pub fn expression(
+        &mut self,
+        owner: Id,
+        field: Field,
+        expression: &a::Expr,
+        parent: Parent,
+    ) -> Result<String, Error> {
+        self.run(owner, binding_field(field), |writer| {
+            let (_, scope) = writer.model_binding(owner, field)?;
+            writer.emit_expression(expression, scope, parent)
+        })
+    }
+    fn parameter_value(&mut self, calculation: Id, id: a::ParameterId) -> Result<(), Error> {
+        self.entry()?;
+        let parameter = *self
+            .parameters
+            .get(&calculation)
+            .and_then(|parameters| parameters.get(&id))
+            .ok_or_else(|| self.error("Unknown scoped parameter."))?;
+        self.text("input ")?;
+        self.name(&parameter.name)?;
+        self.text(" id \"")?;
+        self.text(&parameter.id.0.to_string())?;
+        self.text("\" : ")?;
+        self.type_value(&parameter.value_type)?;
+        self.text(";")
+    }
+    pub fn parameter(
+        &mut self,
+        calculation: Id,
+        parameter: a::ParameterId,
+    ) -> Result<String, Error> {
+        self.run(calculation, "input", |writer| {
+            writer.parameter_value(calculation, parameter)
+        })
+    }
+    fn override_value(&mut self, property: Id, binding: &a::Binding) -> Result<(), Error> {
+        self.entry()?;
+        let alias = self.property_name(property)?;
+        self.text("@")?;
+        self.name(alias)?;
+        self.text(" = ")?;
+        self.binding_value(binding, None)?;
+        self.text(";")
+    }
+    pub fn override_entry(&mut self, case: Id, property: Id) -> Result<String, Error> {
+        self.run(case, "overrides", |writer| {
+            let (binding, _) = writer.model_binding(case, Field::Override(property))?;
+            writer.override_value(property, binding)
+        })
+    }
+    fn header(
+        &mut self,
+        word: &str,
+        alias: &str,
+        name: &str,
+        id: Id,
+        description: &str,
+    ) -> Result<(), Error> {
+        self.entry()?;
+        self.text("    ")?;
+        self.text(word)?;
+        self.text(" ")?;
+        self.name(alias)?;
+        self.text(" ")?;
+        self.quote(name)?;
+        self.text(" id \"")?;
+        self.text(&id.to_string())?;
+        self.text("\" {\n")?;
+        self.start_field("description")?;
+        self.quote(description)?;
+        self.text(";\n")
+    }
+    fn start_field(&mut self, name: &'static str) -> Result<(), Error> {
+        self.field = name;
+        self.entry()?;
+        self.text("        ")?;
+        self.text(name)?;
+        self.text(" ")
+    }
+    pub fn definition(&mut self, id: Id) -> Result<String, Error> {
+        self.run(id, "definition", |writer| {
+            let project = writer.project;
+            let definition = project
+                .definitions
+                .get(&id)
+                .ok_or_else(|| writer.error("Unknown definition."))?;
+            let word = match &definition.body {
+                a::DefinitionBody::QuantityKind(_) => "quantity_kind",
+                a::DefinitionBody::Unit(_) => "unit",
+                a::DefinitionBody::Calculation(_) => "calculation",
+            };
+            writer.header(
+                word,
+                &definition.alias,
+                &definition.name,
+                id,
+                &definition.description,
+            )?;
+            match &definition.body {
+                a::DefinitionBody::QuantityKind(kind) => {
+                    writer.start_field("dimension")?;
+                    writer.text("{")?;
+                    const AXES: [&str; 7] = [
+                        "length",
+                        "mass",
+                        "time",
+                        "electric_current",
+                        "temperature",
+                        "amount",
+                        "luminous_intensity",
+                    ];
+                    let mut nonzero = false;
+                    for (axis, exponent) in AXES.into_iter().zip(kind.dimension.exponents()) {
+                        if exponent != 0 {
+                            writer.entry()?;
+                            writer.text(" ")?;
+                            writer.text(axis)?;
+                            writer.text(" ")?;
+                            writer.text(&exponent.to_string())?;
+                            writer.text(";")?;
+                            nonzero = true;
+                        }
+                    }
+                    if nonzero {
+                        writer.text(" ")?;
+                    }
+                    writer.text("};\n")?;
+                    writer.start_field("algebra")?;
+                    match kind.algebra {
+                        a::QuantityAlgebra::Linear => writer.text("Linear")?,
+                        a::QuantityAlgebra::Affine { difference } => {
+                            writer.text("Affine(")?;
+                            writer.definition_ref(difference, DefinitionKind::QuantityKind)?;
+                            writer.text(")")?;
+                        }
+                    }
+                    writer.text(";\n")?;
+                }
+                a::DefinitionBody::Unit(unit) => {
+                    writer.start_field("kind")?;
+                    writer.definition_ref(unit.kind, DefinitionKind::QuantityKind)?;
+                    writer.text(";\n")?;
+                    writer.start_field("scale")?;
+                    writer.exact(&unit.scale)?;
+                    writer.text(";\n")?;
+                    writer.start_field("offset")?;
+                    writer.exact(&unit.offset)?;
+                    writer.text(";\n")?;
+                    writer.start_field("symbol")?;
+                    writer.quote(&unit.symbol)?;
+                    writer.text(";\n")?;
+                }
+                a::DefinitionBody::Calculation(calculation) => {
+                    for parameter in &calculation.parameters {
+                        writer.field = "input";
+                        writer.text("        ")?;
+                        writer.parameter_value(id, parameter.id)?;
+                        writer.text("\n")?;
+                    }
+                    writer.start_field("result")?;
+                    writer.type_value(&calculation.result)?;
+                    writer.text(";\n")?;
+                    writer.start_field("body")?;
+                    writer.binding_value(&calculation.body, Some(id))?;
+                    writer.text(";\n")?;
+                }
+            }
+            writer.text("    }\n\n")
+        })
+    }
+    pub fn analysis_element(&mut self, id: Id) -> Result<String, Error> {
+        self.run(id, "element", |writer| {
+            let project = writer.project;
+            let element = project
+                .elements
+                .get(&id)
+                .ok_or_else(|| writer.error("Unknown analysis element."))?;
+            let word = match (element.kind(), element.layer()) {
+                (Kind::EngineeringProperty, Layer::Oa) => "oa_property",
+                (Kind::EngineeringProperty, Layer::Sa) => "sa_property",
+                (Kind::AnalysisCheck, Layer::Oa) => "oa_check",
+                (Kind::AnalysisCheck, Layer::Sa) => "sa_check",
+                (Kind::AnalysisCase, Layer::Oa) => "oa_analysis",
+                (Kind::AnalysisCase, Layer::Sa) => "sa_analysis",
+                _ => return Err(writer.error("Expected an analysis element.")),
+            };
+            if element.parent.is_some() {
+                return Err(writer.error("Analysis declarations must be roots."));
+            }
+            writer.header(
+                word,
+                &element.alias,
+                &element.name,
+                id,
+                &element.description,
+            )?;
+            writer.start_field("parent")?;
+            writer.text("none;\n")?;
+            match element.shared().expect("analysis kind is a shared body") {
+                SharedBody::EngineeringProperty {
+                    subject,
+                    value_type,
+                    display_unit,
+                    base,
+                } => {
+                    writer.start_field("subject")?;
+                    writer.subject(*subject)?;
+                    writer.text(";\n")?;
+                    writer.start_field("type")?;
+                    writer.type_value(value_type)?;
+                    writer.text(";\n")?;
+                    writer.start_field("display_unit")?;
+                    if let Some(unit) = display_unit {
+                        writer.definition_ref(*unit, DefinitionKind::Unit)?;
+                    } else {
+                        writer.text("none")?;
+                    }
+                    writer.text(";\n")?;
+                    writer.start_field("base")?;
+                    writer.binding_value(base, None)?;
+                    writer.text(";\n")?;
+                }
+                SharedBody::AnalysisCheck {
+                    subject,
+                    documented_constraint,
+                    predicate,
+                } => {
+                    writer.start_field("subject")?;
+                    writer.optional_subject(*subject)?;
+                    writer.text(";\n")?;
+                    writer.start_field("documented_constraint")?;
+                    if let Some(id) = documented_constraint {
+                        let alias = project
+                            .elements
+                            .get(id)
+                            .filter(|element| element.kind() == Kind::Constraint)
+                            .map(|element| element.alias.as_str())
+                            .ok_or_else(|| {
+                                writer.error("Unknown constraint or wrong reference domain.")
+                            })?;
+                        writer.text("@")?;
+                        writer.name(alias)?;
+                    } else {
+                        writer.text("none")?;
+                    }
+                    writer.text(";\n")?;
+                    writer.start_field("predicate")?;
+                    writer.binding_value(predicate, None)?;
+                    writer.text(";\n")?;
+                }
+                SharedBody::AnalysisCase {
+                    subject,
+                    base: a::BaselineBase::ModelBaseline,
+                    overrides,
+                } => {
+                    writer.start_field("subject")?;
+                    writer.optional_subject(*subject)?;
+                    writer.text(";\n")?;
+                    writer.start_field("base")?;
+                    writer.text("ModelBaseline;\n")?;
+                    writer.start_field("overrides")?;
+                    if overrides.is_empty() {
+                        writer.text("{};\n")?;
+                    } else {
+                        writer.text("{\n")?;
+                        for (property, binding) in overrides {
+                            writer.text("            ")?;
+                            writer.override_value(*property, binding)?;
+                            writer.text("\n")?;
+                        }
+                        writer.text("        };\n")?;
+                    }
+                }
+                _ => return Err(writer.error("Expected an analysis body.")),
+            }
+            writer.text("    }\n\n")
+        })
+    }
+    pub fn typed_declarations(&mut self) -> Result<Vec<(Id, String)>, Error> {
+        if let Some(error) = &self.failed {
+            return Err(error.clone());
+        }
+        let project = self.project;
+        let mut declarations = Vec::new();
+        for id in project.definitions.keys() {
+            declarations.push((*id, self.definition(*id)?));
+        }
+        for element in project
+            .elements
+            .values()
+            .filter(|element| element.kind().is_analysis())
+        {
+            declarations.push((element.id, self.analysis_element(element.id)?));
+        }
+        Ok(declarations)
+    }
+}
+
+#[derive(Clone, Copy)]
+enum DefinitionKind {
+    QuantityKind,
+    Unit,
+    Calculation,
+}
+
+fn binding_field(field: Field) -> &'static str {
+    match field {
+        Field::Body => "body",
+        Field::Base => "base",
+        Field::Predicate => "predicate",
+        Field::Override(_) => "overrides",
+        _ => "binding",
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/write/expression.rs

@@ -0,0 +1,284 @@
+use super::*;
+
+#[derive(Clone, Copy)]
+pub enum Side {
+    Left,
+    Right,
+}
+#[derive(Clone, Copy)]
+pub enum Parent {
+    Root,
+    Binary(a::BinaryOp, Side),
+    Negate,
+}
+
+fn operator(op: a::BinaryOp) -> (&'static str, u8) {
+    use a::BinaryOp::*;
+    match op {
+        Or => (" or ", 1),
+        And => (" and ", 2),
+        Equal => (" == ", 3),
+        NotEqual => (" != ", 3),
+        Less => (" < ", 4),
+        LessOrEqual => (" <= ", 4),
+        Greater => (" > ", 4),
+        GreaterOrEqual => (" >= ", 4),
+        Add => (" + ", 5),
+        Subtract => (" - ", 5),
+        Multiply => (" * ", 6),
+        Divide => (" / ", 6),
+    }
+}
+fn comparison(op: a::BinaryOp) -> bool {
+    matches!(operator(op).1, 3 | 4)
+}
+fn group(expression: &a::Expr, parent: Parent) -> bool {
+    let a::Expr::Binary { op, .. } = expression else {
+        return false;
+    };
+    match parent {
+        Parent::Root => false,
+        Parent::Negate => true,
+        Parent::Binary(parent, side) => {
+            (comparison(*op) && comparison(parent))
+                || operator(*op).1 < operator(parent).1
+                || (operator(*op).1 == operator(parent).1 && matches!(side, Side::Right))
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+enum Task<'a> {
+    Expression(&'a a::Expr, Parent, usize),
+    Text(&'static str),
+    Alias(&'a str),
+    Literal(&'a Exact),
+    Exponent(i8),
+}
+fn schedule<'a>(
+    writer: &Writer<'_>,
+    tasks: &mut Vec<Task<'a>>,
+    ordered: &[Task<'a>],
+) -> Result<(), Error> {
+    writer.pending(tasks.len().saturating_add(ordered.len()))?;
+    tasks.extend(ordered.iter().rev().copied());
+    Ok(())
+}
+
+impl Writer<'_> {
+    pub(super) fn emit_expression(
+        &mut self,
+        expression: &a::Expr,
+        calculation: Option<Id>,
+        parent: Parent,
+    ) -> Result<(), Error> {
+        self.pending(1)?;
+        let mut tasks = vec![Task::Expression(expression, parent, 1)];
+        while let Some(task) = tasks.pop() {
+            match task {
+                Task::Text(text) => self.text(text)?,
+                Task::Alias(name) => {
+                    self.entry()?;
+                    self.name(name)?;
+                }
+                Task::Literal(exact) => self.exact(exact)?,
+                Task::Exponent(exponent) => self.text(&exponent.to_string())?,
+                Task::Expression(expression, parent, depth) => {
+                    self.entry()?;
+                    if depth > a::MAX_EXPRESSION_DEPTH {
+                        return Err(self.error("Expression depth exceeds128."));
+                    }
+                    if group(expression, parent) {
+                        self.text("(")?;
+                        schedule(self, &mut tasks, &[Task::Text(")")])?;
+                    }
+                    use Task::{Alias, Exponent, Expression as Child, Literal, Text};
+                    use a::Expr as E;
+                    match expression {
+                        E::Boolean(value) => self.text(if *value { "true" } else { "false" })?,
+                        E::Number(value) => self.exact(value)?,
+                        E::Quantity { magnitude, unit } => {
+                            let alias = self.definition_name(*unit, DefinitionKind::Unit)?;
+                            schedule(
+                                self,
+                                &mut tasks,
+                                &[Literal(magnitude), Text(" [@"), Alias(alias), Text("]")],
+                            )?;
+                        }
+                        E::Property(id) => {
+                            let alias = self.property_name(*id)?;
+                            schedule(self, &mut tasks, &[Text("@"), Alias(alias)])?;
+                        }
+                        E::Parameter(parameter) => {
+                            let calculation = calculation.ok_or_else(|| {
+                                self.error("Parameter use requires an owning calculation.")
+                            })?;
+                            let parameter = *self
+                                .parameters
+                                .get(&calculation)
+                                .and_then(|parameters| parameters.get(parameter))
+                                .ok_or_else(|| {
+                                    self.error("Unknown parameter in owning calculation.")
+                                })?;
+                            schedule(self, &mut tasks, &[Text("$"), Alias(&parameter.name)])?;
+                        }
+                        E::List(items) => {
+                            if items.len() > a::MAX_LIST_LENGTH {
+                                return Err(self.error("List exceeds1024 items."));
+                            }
+                            self.pending(
+                                tasks
+                                    .len()
+                                    .saturating_add(items.len().saturating_mul(2))
+                                    .saturating_add(1),
+                            )?;
+                            self.text("[")?;
+                            tasks.push(Text("]"));
+                            for (index, item) in items.iter().enumerate().rev() {
+                                tasks.push(Child(item, Parent::Root, depth + 1));
+                                if index != 0 {
+                                    tasks.push(Text(", "));
+                                }
+                            }
+                        }
+                        E::Unary { op, operand } => match op {
+                            a::UnaryOp::Negate => schedule(
+                                self,
+                                &mut tasks,
+                                &[Text("- "), Child(operand, Parent::Negate, depth + 1)],
+                            )?,
+                            a::UnaryOp::Absolute | a::UnaryOp::Not => schedule(
+                                self,
+                                &mut tasks,
+                                &[
+                                    Text(if *op == a::UnaryOp::Absolute {
+                                        "abs("
+                                    } else {
+                                        "not("
+                                    }),
+                                    Child(operand, Parent::Root, depth + 1),
+                                    Text(")"),
+                                ],
+                            )?,
+                        },
+                        E::Binary { op, left, right } => schedule(
+                            self,
+                            &mut tasks,
+                            &[
+                                Child(left, Parent::Binary(*op, Side::Left), depth + 1),
+                                Text(operator(*op).0),
+                                Child(right, Parent::Binary(*op, Side::Right), depth + 1),
+                            ],
+                        )?,
+                        E::If {
+                            condition,
+                            when_true,
+                            when_false,
+                        } => schedule(
+                            self,
+                            &mut tasks,
+                            &[
+                                Text("if("),
+                                Child(condition, Parent::Root, depth + 1),
+                                Text(", "),
+                                Child(when_true, Parent::Root, depth + 1),
+                                Text(", "),
+                                Child(when_false, Parent::Root, depth + 1),
+                                Text(")"),
+                            ],
+                        )?,
+                        E::Call {
+                            definition,
+                            arguments,
+                        } => {
+                            let alias =
+                                self.definition_name(*definition, DefinitionKind::Calculation)?;
+                            let project = self.project;
+                            let a::DefinitionBody::Calculation(callee) =
+                                &project.definitions[&definition.local()].body
+                            else {
+                                unreachable!("checked calculation domain")
+                            };
+                            if arguments.len() != callee.parameters.len()
+                                || callee
+                                    .parameters
+                                    .iter()
+                                    .any(|parameter| !arguments.contains_key(&parameter.id))
+                            {
+                                return Err(self.error(
+                                    "Call argument IDs must match the called signature exactly.",
+                                ));
+                            }
+                            self.pending(
+                                tasks
+                                    .len()
+                                    .saturating_add(arguments.len().saturating_mul(4))
+                                    .saturating_add(1),
+                            )?;
+                            self.entry()?;
+                            self.text("@")?;
+                            self.name(alias)?;
+                            self.text("(")?;
+                            tasks.push(Text(")"));
+                            for (index, parameter) in callee.parameters.iter().enumerate().rev() {
+                                tasks.push(Child(
+                                    &arguments[&parameter.id],
+                                    Parent::Root,
+                                    depth + 1,
+                                ));
+                                tasks.push(Text(": "));
+                                tasks.push(Alias(&parameter.name));
+                                if index != 0 {
+                                    tasks.push(Text(", "));
+                                }
+                            }
+                        }
+                        E::Sum { values, initial } => schedule(
+                            self,
+                            &mut tasks,
+                            &[
+                                Text("sum("),
+                                Child(values, Parent::Root, depth + 1),
+                                Text(", "),
+                                Child(initial, Parent::Root, depth + 1),
+                                Text(")"),
+                            ],
+                        )?,
+                        E::Power { base, exponent } => {
+                            if !(-16..=16).contains(exponent) {
+                                return Err(self.error("Power exponent exceeds -16..16."));
+                            }
+                            schedule(
+                                self,
+                                &mut tasks,
+                                &[
+                                    Text("power("),
+                                    Child(base, Parent::Root, depth + 1),
+                                    Text(", "),
+                                    Exponent(*exponent),
+                                    Text(")"),
+                                ],
+                            )?;
+                        }
+                        E::AsKind { kind, value } => {
+                            let alias =
+                                self.definition_name(*kind, DefinitionKind::QuantityKind)?;
+                            schedule(
+                                self,
+                                &mut tasks,
+                                &[
+                                    Text("as_kind(@"),
+                                    Alias(alias),
+                                    Text(", "),
+                                    Child(value, Parent::Root, depth + 1),
+                                    Text(")"),
+                                ],
+                            )?;
+                        }
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}

crates/oa-core/src/language/analysis_source/write/tests.rs

@@ -0,0 +1,910 @@
+use super::super::{cursor::Cursor, declarations, lex, lower, model_oracle};
+use super::*;
+use crate::language::ParseLimits;
+use a::{
+    AnalysisType, BinaryOp, Binding, DefinitionBody, DefinitionRef, Expr, ParameterId, ScalarType,
+    UnaryOp,
+};
+
+fn limits() -> Limits {
+    Limits::source8(ParseLimits::UNLIMITED)
+}
+fn writer(project: &Project) -> Writer<'_> {
+    Writer::new(project, limits()).unwrap()
+}
+fn id(text: &str) -> Id {
+    Id::parse_str(text).unwrap()
+}
+fn object(project: &Project, alias: &str) -> Id {
+    project
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+fn number(value: i64) -> Expr {
+    Expr::Number(Exact::from_integer(value))
+}
+fn unary(op: UnaryOp, value: Expr) -> Expr {
+    Expr::Unary {
+        op,
+        operand: Box::new(value),
+    }
+}
+fn binary(op: BinaryOp, left: Expr, right: Expr) -> Expr {
+    Expr::Binary {
+        op,
+        left: Box::new(left),
+        right: Box::new(right),
+    }
+}
+fn quantity(value: i64, unit: Id) -> Expr {
+    Expr::Quantity {
+        magnitude: Exact::from_integer(value),
+        unit: DefinitionRef::Local(unit),
+    }
+}
+fn budget() -> budget::Budget {
+    budget::Budget::new(budget::Limits::source8(ParseLimits::UNLIMITED)).unwrap()
+}
+fn unit(source: &str, budget: &mut budget::Budget) -> Result<lower::Unit, super::super::Error> {
+    let tokens = lex::tokens(source, budget)?;
+    let mut cursor = Cursor::new(source, &tokens, budget);
+    let mut parsed = Vec::new();
+    while cursor.cursor < tokens.len() {
+        parsed.push(declarations::parse(&mut cursor, 8, None)?);
+    }
+    Ok(lower::Unit {
+        file: 1,
+        declarations: parsed,
+    })
+}
+fn merge(mut project: Project, lowered: lower::Lowered) -> Project {
+    project.definitions.extend(lowered.definitions);
+    project.elements.extend(lowered.elements);
+    project
+}
+fn parse_typed(project: Project, source: &str) -> Project {
+    let mut budget = budget();
+    let unit = unit(source, &mut budget).unwrap();
+    let lowered = lower::lower(&project, &[unit], &budget).unwrap();
+    merge(project, lowered)
+}
+fn skeleton(project: &Project) -> Project {
+    let mut project = project.clone();
+    project.definitions.clear();
+    project
+        .elements
+        .retain(|_, element| !element.kind().is_analysis());
+    project
+}
+fn canonical(project: &Project) -> String {
+    writer(project)
+        .typed_declarations()
+        .unwrap()
+        .into_iter()
+        .map(|(_, text)| text)
+        .collect()
+}
+fn read_expression(project: &Project, source: &str) -> Expr {
+    // A staged syntax/lowering wrapper, not a whole public source8 parser.
+    let source = format!(
+        r#"calculation writer_probe "Probe" id "00000000-0000-0000-0000-000000000099" {{
+        input a id "28ff40b0-1b8f-4735-8536-5a6ab21b56cb" : Quantity(@duration);
+        input b id "7a47cc1e-8ae5-4551-b2d8-8a68108e0976" : Quantity(@duration);
+        result Number; body {source};
+    }}"#
+    );
+    let mut parsed = parse_typed(project.clone(), &source);
+    let definition = parsed.definitions.remove(&Id::from_u128(0x99)).unwrap();
+    let DefinitionBody::Calculation(calculation) = definition.body else {
+        panic!("calculation")
+    };
+    let Binding::Expression(expression) = calculation.body else {
+        panic!("expression")
+    };
+    expression
+}
+
+#[test]
+fn typed_oa_sa_canonical_roundtrips_match_independent_projects() {
+    for (layer, ordinary_source) in [
+        (
+            Layer::Oa,
+            include_str!("../lower/fixtures/ordinary-oa.arcadia"),
+        ),
+        (
+            Layer::Sa,
+            include_str!("../lower/fixtures/ordinary-sa.arcadia"),
+        ),
+    ] {
+        let expected = model_oracle::project(layer);
+        for (alias, name) in model_oracle::NAMES {
+            let id = object(&expected, alias);
+            assert_eq!(
+                expected
+                    .definitions
+                    .get(&id)
+                    .map(|value| value.name.as_str())
+                    .or_else(|| expected.elements.get(&id).map(|value| value.name.as_str()))
+                    .unwrap(),
+                name
+            );
+        }
+        let text = canonical(&expected);
+        let actual = parse_typed(crate::language::parse(ordinary_source).unwrap(), &text);
+        assert_eq!(actual, expected);
+        a::admit(&actual, a::AdmissionLimits::REFERENCE).unwrap();
+        assert_eq!(canonical(&actual), text);
+        assert!(
+            !text.contains("engineering_property")
+                && !text.contains("analysis_case")
+                && !text.contains("analysis_check")
+        );
+        let prefix = if layer == Layer::Oa { "oa" } else { "sa" };
+        for word in ["property", "check", "analysis"] {
+            assert!(text.contains(&format!("{prefix}_{word} ")));
+        }
+    }
+    assert!(crate::language::parse("arcadia 8; project p \"P\" {}").is_err());
+}
+
+#[test]
+fn typed_declaration_order_and_required_empty_values_are_canonical() {
+    let mut project = model_oracle::project(Layer::Oa);
+    let duration = object(&project, "duration");
+    let total = object(&project, "total_time");
+    if let Some(SharedBody::EngineeringProperty { display_unit, .. }) =
+        project.elements.get_mut(&total).unwrap().body.shared_mut()
+    {
+        *display_unit = None;
+    }
+    let empty_case = object(&project, "unmeasured");
+    if let Some(SharedBody::AnalysisCase { overrides, .. }) = project
+        .elements
+        .get_mut(&empty_case)
+        .unwrap()
+        .body
+        .shared_mut()
+    {
+        overrides.clear();
+    }
+    let degraded = object(&project, "degraded");
+    let dispatch = object(&project, "dispatch_time");
+    let second = object(&project, "second");
+    if let Some(SharedBody::AnalysisCase { overrides, .. }) = project
+        .elements
+        .get_mut(&degraded)
+        .unwrap()
+        .body
+        .shared_mut()
+    {
+        overrides.insert(dispatch, Binding::Expression(quantity(1, second)));
+    }
+    let definitions = [
+        (
+            100,
+            "dimensionless",
+            DefinitionBody::QuantityKind(a::QuantityKindDefinition {
+                dimension: crate::analysis_numeric::Dimension::ZERO,
+                algebra: a::QuantityAlgebra::Linear,
+            }),
+        ),
+        (
+            101,
+            "point",
+            DefinitionBody::QuantityKind(a::QuantityKindDefinition {
+                dimension: crate::analysis_numeric::Dimension::new([0, 0, 1, 0, 0, 0, 0]).unwrap(),
+                algebra: a::QuantityAlgebra::Affine {
+                    difference: DefinitionRef::Local(duration),
+                },
+            }),
+        ),
+        (
+            102,
+            "point_unit",
+            DefinitionBody::Unit(a::UnitDefinition {
+                kind: DefinitionRef::Local(Id::from_u128(101)),
+                scale: Exact::from_integer(1),
+                offset: Exact::from_integer(-2),
+                symbol: "\"café\"\n雪".into(),
+            }),
+        ),
+        (
+            103,
+            "unused",
+            DefinitionBody::Calculation(a::CalculationDefinition {
+                parameters: Vec::new(),
+                result: AnalysisType::List(ScalarType::Number),
+                body: Binding::Unbound,
+            }),
+        ),
+    ];
+    for (id, alias, body) in definitions {
+        let id = Id::from_u128(id);
+        project.definitions.insert(
+            id,
+            a::Definition {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                body,
+            },
+        );
+    }
+    let mut writer = writer(&project);
+    let declarations = writer.typed_declarations().unwrap();
+    let ids: Vec<_> = declarations.iter().map(|(id, _)| *id).collect();
+    let expected_ids: Vec<_> = project
+        .definitions
+        .keys()
+        .copied()
+        .chain(
+            project
+                .elements
+                .values()
+                .filter(|element| element.kind().is_analysis())
+                .map(|element| element.id),
+        )
+        .collect();
+    assert_eq!(ids, expected_ids);
+    let text: String = declarations.into_iter().map(|(_, text)| text).collect();
+    assert!(text.find("@receive_time =").unwrap() < text.find("@dispatch_time =").unwrap());
+    for expected in [
+        "dimension {};",
+        "dimension { time 1; };",
+        "algebra Affine(@duration);",
+        "offset ratio(-2, 1);",
+        "result List(Number);",
+        "body unbound;",
+        "display_unit none;",
+        "overrides {};",
+        "parent none;",
+        "subject none;",
+        "documented_constraint none;",
+    ] {
+        assert!(text.contains(expected), "{expected}");
+    }
+    assert_eq!(
+        text.matches("\" id \"").count(),
+        project.definitions.len() + 7
+    );
+    let actual = parse_typed(skeleton(&project), &text);
+    assert_eq!(actual, project);
+    a::admit(&actual, a::AdmissionLimits::REFERENCE).unwrap();
+    assert_eq!(canonical(&actual), text);
+    assert_eq!(
+        self::writer(&project)
+            .override_entry(empty_case, total)
+            .unwrap_err()
+            .field,
+        "overrides"
+    );
+}
+
+#[test]
+fn all_expr_variants_and_precedence_preserve_exact_trees() {
+    let mut project = model_oracle::project(Layer::Oa);
+    let second = object(&project, "second");
+    let duration = object(&project, "duration");
+    let property = object(&project, "receive_time");
+    let total = object(&project, "total_time");
+    let combine = object(&project, "combine");
+    let a = ParameterId(id("28ff40b0-1b8f-4735-8536-5a6ab21b56cb"));
+    let b = ParameterId(id("7a47cc1e-8ae5-4551-b2d8-8a68108e0976"));
+    let numeric = AnalysisType::Scalar(ScalarType::Number);
+    let boolean = AnalysisType::Scalar(ScalarType::Boolean);
+    let duration_type = AnalysisType::Scalar(ScalarType::Quantity(DefinitionRef::Local(duration)));
+    let cases = [
+        (Expr::Boolean(true), "true", boolean.clone()),
+        (number(-1), "ratio(-1, 1)", numeric.clone()),
+        (
+            quantity(-1, second),
+            "ratio(-1, 1) [@second]",
+            duration_type.clone(),
+        ),
+        (
+            Expr::Property(property),
+            "@receive_time",
+            duration_type.clone(),
+        ),
+        (Expr::Parameter(a), "$a", duration_type.clone()),
+        (
+            Expr::List(vec![number(1), number(2)]),
+            "[1, 2]",
+            AnalysisType::List(ScalarType::Number),
+        ),
+        (
+            unary(UnaryOp::Absolute, unary(UnaryOp::Negate, number(2))),
+            "abs(- 2)",
+            numeric.clone(),
+        ),
+        (
+            binary(BinaryOp::Add, number(1), number(2)),
+            "1 + 2",
+            numeric.clone(),
+        ),
+        (
+            Expr::If {
+                condition: Box::new(Expr::Boolean(true)),
+                when_true: Box::new(number(1)),
+                when_false: Box::new(number(2)),
+            },
+            "if(true, 1, 2)",
+            numeric.clone(),
+        ),
+        (
+            Expr::Call {
+                definition: DefinitionRef::Local(combine),
+                arguments: BTreeMap::from([(b, quantity(2, second)), (a, quantity(1, second))]),
+            },
+            "@combine(a: 1 [@second], b: 2 [@second])",
+            duration_type.clone(),
+        ),
+        (
+            Expr::Sum {
+                values: Box::new(Expr::List(vec![number(1), number(2)])),
+                initial: Box::new(number(0)),
+            },
+            "sum([1, 2], 0)",
+            numeric.clone(),
+        ),
+        (
+            Expr::Power {
+                base: Box::new(number(2)),
+                exponent: -2,
+            },
+            "power(2, -2)",
+            numeric.clone(),
+        ),
+        (
+            Expr::AsKind {
+                kind: DefinitionRef::Local(duration),
+                value: Box::new(binary(
+                    BinaryOp::Divide,
+                    Expr::Power {
+                        base: Box::new(quantity(1, second)),
+                        exponent: 2,
+                    },
+                    quantity(1, second),
+                )),
+            },
+            "as_kind(@duration, power(1 [@second], 2) / 1 [@second])",
+            duration_type,
+        ),
+    ];
+    project.elements.remove(&object(&project, "budget"));
+    for (expected, golden, value_type) in cases {
+        let parameter = matches!(expected, Expr::Parameter(_));
+        let owner = if parameter { combine } else { total };
+        let field = if parameter { Field::Body } else { Field::Base };
+        let text = writer(&project)
+            .expression(owner, field, &expected, Parent::Root)
+            .unwrap();
+        assert_eq!(text, golden);
+        let actual = read_expression(&project, &text);
+        assert_eq!(actual, expected);
+        let mut candidate = project.clone();
+        if parameter {
+            let DefinitionBody::Calculation(calculation) =
+                &mut candidate.definitions.get_mut(&combine).unwrap().body
+            else {
+                panic!()
+            };
+            calculation.body = Binding::Expression(actual);
+        } else {
+            let Some(SharedBody::EngineeringProperty {
+                base,
+                value_type: ty,
+                display_unit,
+                ..
+            }) = candidate
+                .elements
+                .get_mut(&total)
+                .unwrap()
+                .body
+                .shared_mut()
+            else {
+                panic!()
+            };
+            *base = Binding::Expression(actual);
+            *ty = value_type;
+            *display_unit = None;
+        }
+        a::admit(&candidate, a::AdmissionLimits::REFERENCE).unwrap();
+    }
+    let cases = [
+        (unary(UnaryOp::Negate, number(1)), "- 1"),
+        (unary(UnaryOp::Negate, number(-1)), "- ratio(-1, 1)"),
+        (
+            unary(UnaryOp::Negate, unary(UnaryOp::Negate, number(1))),
+            "- - 1",
+        ),
+        (
+            unary(UnaryOp::Negate, binary(BinaryOp::Add, number(1), number(2))),
+            "- (1 + 2)",
+        ),
+        (unary(UnaryOp::Not, Expr::Boolean(true)), "not(true)"),
+        (
+            binary(
+                BinaryOp::Subtract,
+                number(1),
+                binary(BinaryOp::Subtract, number(2), number(3)),
+            ),
+            "1 - (2 - 3)",
+        ),
+        (
+            binary(
+                BinaryOp::Subtract,
+                binary(BinaryOp::Subtract, number(1), number(2)),
+                number(3),
+            ),
+            "1 - 2 - 3",
+        ),
+        (
+            binary(
+                BinaryOp::Add,
+                number(1),
+                binary(BinaryOp::Add, number(2), number(3)),
+            ),
+            "1 + (2 + 3)",
+        ),
+        (
+            binary(
+                BinaryOp::Multiply,
+                binary(BinaryOp::Add, number(1), number(2)),
+                number(3),
+            ),
+            "(1 + 2) * 3",
+        ),
+        (
+            binary(
+                BinaryOp::Equal,
+                binary(BinaryOp::Less, number(1), number(2)),
+                Expr::Boolean(true),
+            ),
+            "(1 < 2) == true",
+        ),
+        (
+            binary(
+                BinaryOp::Equal,
+                binary(BinaryOp::Equal, Expr::Boolean(true), Expr::Boolean(false)),
+                Expr::Boolean(true),
+            ),
+            "(true == false) == true",
+        ),
+        (
+            binary(
+                BinaryOp::Equal,
+                Expr::Boolean(true),
+                binary(BinaryOp::Less, number(1), number(2)),
+            ),
+            "true == (1 < 2)",
+        ),
+        (Expr::List(Vec::new()), "[]"),
+    ];
+    for (expected, golden) in cases {
+        let text = writer(&project)
+            .expression(total, Field::Base, &expected, Parent::Root)
+            .unwrap();
+        assert_eq!(text, golden);
+        assert_eq!(read_expression(&project, &text), expected);
+    }
+}
+
+#[test]
+fn canonical_calls_use_callee_parameter_order_and_qualified_names() {
+    let mut project = model_oracle::project(Layer::Oa);
+    let combine = object(&project, "combine");
+    let total = object(&project, "total_time");
+    let duration = object(&project, "duration");
+    let a = ParameterId(id("28ff40b0-1b8f-4735-8536-5a6ab21b56cb"));
+    let b = ParameterId(id("7a47cc1e-8ae5-4551-b2d8-8a68108e0976"));
+    let DefinitionBody::Calculation(calculation) =
+        &mut project.definitions.get_mut(&combine).unwrap().body
+    else {
+        panic!()
+    };
+    calculation.parameters.reverse();
+    let other = Id::from_u128(120);
+    project.definitions.insert(
+        other,
+        a::Definition {
+            id: other,
+            alias: "other".into(),
+            name: "Other".into(),
+            description: String::new(),
+            body: DefinitionBody::Calculation(a::CalculationDefinition {
+                parameters: vec![a::Parameter {
+                    id: a,
+                    name: "first".into(),
+                    value_type: AnalysisType::Scalar(ScalarType::Quantity(DefinitionRef::Local(
+                        duration,
+                    ))),
+                }],
+                result: AnalysisType::Scalar(ScalarType::Quantity(DefinitionRef::Local(duration))),
+                body: Binding::Expression(Expr::Parameter(a)),
+            }),
+        },
+    );
+    project.definitions.insert(
+        a.0,
+        a::Definition {
+            id: a.0,
+            alias: "collision".into(),
+            name: "Collision".into(),
+            description: String::new(),
+            body: DefinitionBody::QuantityKind(a::QuantityKindDefinition {
+                dimension: crate::analysis_numeric::Dimension::ZERO,
+                algebra: a::QuantityAlgebra::Linear,
+            }),
+        },
+    );
+    let mut out = writer(&project);
+    let text = out.binding(total, Field::Base).unwrap();
+    assert!(text.starts_with("@combine(b: @dispatch_time, a: @receive_time)"));
+    let call = Expr::Call {
+        definition: DefinitionRef::Local(other),
+        arguments: BTreeMap::from([(a, Expr::Parameter(a))]),
+    };
+    assert_eq!(
+        out.expression(combine, Field::Body, &call, Parent::Root)
+            .unwrap(),
+        "@other(first: $a)"
+    );
+    assert!(out.parameter(combine, a).unwrap().starts_with("input a id"));
+    assert!(
+        out.parameter(other, a)
+            .unwrap()
+            .starts_with("input first id")
+    );
+    assert!(out.parameter(combine, b).unwrap().starts_with("input b id"));
+    let text = canonical(&project);
+    let actual = parse_typed(skeleton(&project), &text);
+    assert_eq!(actual, project);
+    a::admit(&actual, a::AdmissionLimits::REFERENCE).unwrap();
+}
+
+#[test]
+fn subtree_output_respects_parent_context_and_retained_delimiters() {
+    let project = model_oracle::project(Layer::Oa);
+    let owner = object(&project, "total_time");
+    for replacement in [
+        binary(BinaryOp::Add, number(1), number(2)),
+        number(-1),
+        unary(UnaryOp::Negate, number(1)),
+    ] {
+        let text = writer(&project)
+            .expression(owner, Field::Base, &replacement, Parent::Negate)
+            .unwrap();
+        let source = format!("-{text}"); // replace the entire original operand span `(1)` in `-(1)`
+        assert_eq!(
+            read_expression(&project, &source),
+            unary(UnaryOp::Negate, replacement)
+        );
+    }
+    let value = binary(BinaryOp::Subtract, number(2), number(3));
+    let text = writer(&project)
+        .expression(
+            owner,
+            Field::Base,
+            &value,
+            Parent::Binary(BinaryOp::Subtract, Side::Right),
+        )
+        .unwrap();
+    assert_eq!(text, "(2 - 3)");
+    assert_eq!(
+        read_expression(&project, &format!("1 - {text}")),
+        binary(BinaryOp::Subtract, number(1), value)
+    );
+    assert_eq!(
+        writer(&project)
+            .value_type(owner, &AnalysisType::List(ScalarType::Boolean))
+            .unwrap(),
+        "List(Boolean)"
+    );
+    let case = object(&project, "unmeasured");
+    let property = object(&project, "receive_time");
+    assert_eq!(
+        writer(&project).override_entry(case, property).unwrap(),
+        "@receive_time = unbound;"
+    );
+}
+
+#[test]
+fn canonical_strings_and_exact_literals_use_existing_encodings() {
+    let mut project = model_oracle::project(Layer::Oa);
+    let second = object(&project, "second");
+    let text = "\"\\\n\r\t\u{0000} café 雪";
+    project.definitions.get_mut(&second).unwrap().name = text.into();
+    project.definitions.get_mut(&second).unwrap().description = text.into();
+    let DefinitionBody::Unit(unit) = &mut project.definitions.get_mut(&second).unwrap().body else {
+        panic!()
+    };
+    unit.symbol = text.into();
+    let output = writer(&project).definition(second).unwrap();
+    assert_eq!(output.matches(&crate::language::quote(text)).count(), 3);
+    let actual = parse_typed(skeleton(&project), &canonical(&project));
+    assert_eq!(actual, project);
+    let owner = object(&project, "total_time");
+    for source in ["0", "ratio(-1, 1)", "ratio(3, 2)", "1e100"] {
+        let expression = read_expression(&project, source);
+        let Expr::Number(value) = &expression else {
+            panic!()
+        };
+        assert_eq!(
+            writer(&project)
+                .expression(owner, Field::Base, &expression, Parent::Root)
+                .unwrap(),
+            value.canonical_literal()
+        );
+    }
+}
+
+#[test]
+fn writer_limits_are_aggregate_exact_and_latched_without_partial_results() {
+    let project = model_oracle::project(Layer::Oa);
+    let owner = object(&project, "total_time");
+    let mut one = Writer::new(
+        &project,
+        Limits {
+            bytes: 1,
+            ..limits()
+        },
+    )
+    .unwrap();
+    assert_eq!(
+        one.expression(owner, Field::Base, &number(1), Parent::Root)
+            .unwrap(),
+        "1"
+    );
+    let failure = one
+        .expression(owner, Field::Base, &number(2), Parent::Root)
+        .unwrap_err();
+    assert_eq!(
+        failure,
+        one.expression(owner, Field::Base, &number(0), Parent::Root)
+            .unwrap_err()
+    );
+    assert_eq!(one.usage().bytes, 1);
+    let mut measured = writer(&project);
+    measured
+        .expression(owner, Field::Base, &number(1), Parent::Root)
+        .unwrap();
+    let usage = measured.usage();
+    for (maximum, pass) in [(usage.entries, true), (usage.entries - 1, false)] {
+        let mut bounded = Writer::new(
+            &project,
+            Limits {
+                entries: maximum,
+                ..limits()
+            },
+        )
+        .unwrap();
+        assert_eq!(
+            bounded
+                .expression(owner, Field::Base, &number(1), Parent::Root)
+                .is_ok(),
+            pass
+        );
+    }
+    let output = canonical(&project);
+    let mut exact = Writer::new(
+        &project,
+        Limits {
+            bytes: output.len(),
+            ..limits()
+        },
+    )
+    .unwrap();
+    assert_eq!(exact.typed_declarations().unwrap().len(), 11);
+    let mut short = Writer::new(
+        &project,
+        Limits {
+            bytes: output.len() - 1,
+            ..limits()
+        },
+    )
+    .unwrap();
+    assert!(short.typed_declarations().is_err());
+    assert_eq!(canonical(&project), output);
+    let mut quoted = project.clone();
+    let unit_id = object(&quoted, "second");
+    quoted.definitions.get_mut(&unit_id).unwrap().name = "雪\n\"".into();
+    let text = writer(&quoted).definition(unit_id).unwrap();
+    for (maximum, pass) in [(text.len(), true), (text.len() - 1, false)] {
+        assert_eq!(
+            Writer::new(
+                &quoted,
+                Limits {
+                    bytes: maximum,
+                    ..limits()
+                }
+            )
+            .unwrap()
+            .definition(unit_id)
+            .is_ok(),
+            pass
+        );
+    }
+    assert!(
+        Writer::new(
+            &project,
+            Limits {
+                bytes: usize::MAX,
+                ..limits()
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn writer_lookup_scope_shape_and_depth_failures_are_model_located() {
+    let project = model_oracle::project(Layer::Oa);
+    let owner = object(&project, "total_time");
+    let combine = object(&project, "combine");
+    let duration = object(&project, "duration");
+    let a = ParameterId(id("28ff40b0-1b8f-4735-8536-5a6ab21b56cb"));
+    let cases = [
+        Expr::Property(duration),
+        Expr::Property(Id::nil()),
+        Expr::Quantity {
+            magnitude: Exact::from_integer(1),
+            unit: DefinitionRef::Local(duration),
+        },
+        Expr::Parameter(a),
+        Expr::Call {
+            definition: DefinitionRef::Local(duration),
+            arguments: BTreeMap::new(),
+        },
+        Expr::Call {
+            definition: DefinitionRef::Local(combine),
+            arguments: BTreeMap::new(),
+        },
+        Expr::Call {
+            definition: DefinitionRef::Local(combine),
+            arguments: BTreeMap::from([(ParameterId(Id::nil()), number(1)), (a, number(2))]),
+        },
+        Expr::Power {
+            base: Box::new(number(1)),
+            exponent: 17,
+        },
+        Expr::List((0..1025).map(|_| number(1)).collect()),
+    ];
+    for expression in cases {
+        let error = writer(&project)
+            .expression(owner, Field::Base, &expression, Parent::Root)
+            .unwrap_err();
+        assert_eq!(error.owner, Some(owner));
+        assert_eq!(error.field, "base");
+    }
+    assert!(
+        writer(&project)
+            .expression(
+                combine,
+                Field::Body,
+                &Expr::Parameter(ParameterId(Id::nil())),
+                Parent::Root
+            )
+            .is_err()
+    );
+    assert!(writer(&project).binding(owner, Field::Body).is_err());
+    assert!(
+        writer(&project)
+            .analysis_element(object(&project, "respond"))
+            .is_err()
+    );
+    let mut deep = number(-1);
+    for _ in 0..128 {
+        deep = unary(UnaryOp::Negate, deep);
+    }
+    assert!(
+        writer(&project)
+            .expression(owner, Field::Base, &deep, Parent::Root)
+            .unwrap_err()
+            .message
+            .contains("depth")
+    );
+}
+
+#[test]
+fn negate_override_roundtrip_preserves_depth128_within_frame256() {
+    let original = model_oracle::project(Layer::Oa);
+    let prefix = format!("{}ratio(-1, 1)", "- ".repeat(127));
+    let grouped = format!("{}ratio(-1, 1){}", "-(".repeat(127), ")".repeat(127));
+    let property = r#"oa_property measure "Measure" id "00000000-0000-0000-0000-000000000130" { subject @respond; type Number; base unbound; }"#;
+    let case = |expression: &str| {
+        format!(
+            r#"oa_analysis measured "Measured" id "00000000-0000-0000-0000-000000000131" {{ base ModelBaseline; overrides {{ @measure = {expression}; }}; }}"#
+        )
+    };
+    let calculation = |expression: &str| {
+        format!(
+            r#"calculation measured_calc "Measured calculation" id "00000000-0000-0000-0000-000000000132" {{ result Number; body {expression}; }}"#
+        )
+    };
+    for (source, frames) in [
+        (case(&prefix), 130),
+        (calculation(&prefix), 129),
+        (calculation(&grouped), 256),
+    ] {
+        let mut budget = budget();
+        unit(&source, &mut budget).unwrap();
+        assert_eq!(budget.usage.deepest_frame, frames);
+    }
+    let mut failed_budget = budget();
+    let error = unit(&case(&grouped), &mut failed_budget).err().unwrap();
+    assert!(error.message.contains("syntax frames"));
+    assert_eq!(failed_budget.usage.deepest_frame, 256);
+    let project = parse_typed(original, &format!("{property}\n{}", case(&prefix)));
+    a::admit(&project, a::AdmissionLimits::REFERENCE).unwrap();
+    let case_id = Id::from_u128(0x131);
+    let property_id = Id::from_u128(0x130);
+    let Some(SharedBody::AnalysisCase { overrides, .. }) = project.elements[&case_id].shared()
+    else {
+        panic!()
+    };
+    let Binding::Expression(root) = &overrides[&property_id] else {
+        panic!()
+    };
+    let mut current = root;
+    let mut negates = 0;
+    while let Expr::Unary {
+        op: UnaryOp::Negate,
+        operand,
+    } = current
+    {
+        current = operand;
+        negates += 1;
+    }
+    assert_eq!(negates, 127);
+    assert_eq!(current, &number(-1));
+    let text = writer(&project).analysis_element(case_id).unwrap();
+    assert!(text.contains(&prefix));
+    let mut budget = budget();
+    unit(&text, &mut budget).unwrap();
+    assert_eq!(budget.usage.deepest_frame, 130);
+    let mut before_case = project.clone();
+    before_case.elements.remove(&case_id);
+    let actual = parse_typed(before_case, &text);
+    assert_eq!(actual, project);
+    assert_eq!(writer(&actual).analysis_element(case_id).unwrap(), text);
+}
+
+#[test]
+fn iterative_writer_preserves_width1024_and_empty_call_topology() {
+    let mut project = model_oracle::project(Layer::Oa);
+    let owner = object(&project, "total_time");
+    let expected = Expr::List((0..1024).map(|_| number(1)).collect());
+    let text = writer(&project)
+        .expression(owner, Field::Base, &expected, Parent::Root)
+        .unwrap();
+    assert_eq!(read_expression(&project, &text), expected);
+    let empty = Id::from_u128(140);
+    project.definitions.insert(
+        empty,
+        a::Definition {
+            id: empty,
+            alias: "empty".into(),
+            name: "Empty".into(),
+            description: String::new(),
+            body: DefinitionBody::Calculation(a::CalculationDefinition {
+                parameters: Vec::new(),
+                result: AnalysisType::Scalar(ScalarType::Number),
+                body: Binding::Unbound,
+            }),
+        },
+    );
+    let call = Expr::Call {
+        definition: DefinitionRef::Local(empty),
+        arguments: BTreeMap::new(),
+    };
+    let text = writer(&project)
+        .expression(owner, Field::Base, &call, Parent::Root)
+        .unwrap();
+    assert_eq!(text, "@empty()");
+    assert_eq!(read_expression(&project, &text), call);
+}

crates/oa-core/src/language/raw_tokens.rs

@@ -0,0 +1,347 @@
+//! One raw lexical scan for legacy adapters and staged typed source syntax.
+//! Numbers remain source spans; only consumers choose a numeric domain.
+use super::Span;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Class {
+    Word,
+    Number,
+    String,
+    Punctuation,
+    Whitespace,
+    Comment,
+    Error,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(super) struct Token {
+    pub class: Class,
+    pub span: Span,
+    /// Entire token belongs to the old greedy numeric-token alphabet.
+    pub legacy_number_part: bool,
+}
+
+pub(super) struct Scanner<'a> {
+    source: &'a str,
+    cursor: usize,
+}
+
+impl<'a> Scanner<'a> {
+    pub fn new(source: &'a str) -> Self {
+        Self { source, cursor: 0 }
+    }
+}
+
+impl Iterator for Scanner<'_> {
+    type Item = Token;
+
+    fn next(&mut self) -> Option<Token> {
+        let source = self.source;
+        let bytes = source.as_bytes();
+        let start = self.cursor;
+        let first = *bytes.get(start)?;
+        let mut legacy_number_part = false;
+        let class = if matches!(first, b' ' | b'\t' | b'\r' | b'\n') {
+            self.cursor += 1;
+            while bytes
+                .get(self.cursor)
+                .is_some_and(|b| matches!(b, b' ' | b'\t' | b'\r' | b'\n'))
+            {
+                self.cursor += 1;
+            }
+            Class::Whitespace
+        } else if bytes[start..].starts_with(b"//") {
+            self.cursor += 2;
+            while bytes.get(self.cursor).is_some_and(|b| *b != b'\n') {
+                self.cursor += 1;
+            }
+            Class::Comment
+        } else if first.is_ascii_alphabetic() || first == b'_' {
+            self.cursor += 1;
+            while bytes
+                .get(self.cursor)
+                .is_some_and(|b| b.is_ascii_alphanumeric() || *b == b'_')
+            {
+                self.cursor += 1;
+            }
+            legacy_number_part = true;
+            Class::Word
+        } else if first.is_ascii_digit() {
+            while bytes.get(self.cursor).is_some_and(u8::is_ascii_digit) {
+                self.cursor += 1;
+            }
+            let mut valid = true;
+            if bytes.get(self.cursor) == Some(&b'.') {
+                self.cursor += 1;
+                let fraction = self.cursor;
+                while bytes.get(self.cursor).is_some_and(u8::is_ascii_digit) {
+                    self.cursor += 1;
+                }
+                valid &= self.cursor != fraction;
+            }
+            if matches!(bytes.get(self.cursor), Some(b'e' | b'E')) {
+                self.cursor += 1;
+                if matches!(bytes.get(self.cursor), Some(b'+' | b'-')) {
+                    self.cursor += 1;
+                }
+                let exponent = self.cursor;
+                while bytes.get(self.cursor).is_some_and(u8::is_ascii_digit) {
+                    self.cursor += 1;
+                }
+                valid &= self.cursor != exponent;
+            }
+            if bytes
+                .get(self.cursor)
+                .is_some_and(|b| b.is_ascii_alphabetic() || matches!(b, b'_' | b'.'))
+            {
+                valid = false;
+                while bytes
+                    .get(self.cursor)
+                    .is_some_and(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'.'))
+                {
+                    self.cursor += 1;
+                }
+            }
+            legacy_number_part = true;
+            if valid { Class::Number } else { Class::Error }
+        } else if first == b'"' {
+            self.cursor += 1;
+            let mut escaped = false;
+            let mut closed = false;
+            while self.cursor < bytes.len() {
+                let ch = source[self.cursor..]
+                    .chars()
+                    .next()
+                    .expect("UTF-8 boundary");
+                self.cursor += ch.len_utf8();
+                if escaped {
+                    escaped = false;
+                } else if ch == '\\' {
+                    escaped = true;
+                } else if ch == '"' {
+                    closed = true;
+                    break;
+                }
+            }
+            if closed && serde_json::from_str::<String>(&source[start..self.cursor]).is_ok() {
+                Class::String
+            } else {
+                Class::Error
+            }
+        } else if b"{}();,[]:=@$+-*/<>!".contains(&first) {
+            self.cursor += 1;
+            if matches!(first, b'<' | b'>' | b'=' | b'!') && bytes.get(self.cursor) == Some(&b'=') {
+                self.cursor += 1;
+            }
+            legacy_number_part = matches!(first, b'+' | b'-');
+            Class::Punctuation
+        } else {
+            self.cursor += source[start..]
+                .chars()
+                .next()
+                .expect("UTF-8 boundary")
+                .len_utf8();
+            legacy_number_part = first == b'.';
+            Class::Error
+        };
+        Some(Token {
+            class,
+            span: Span {
+                start,
+                end: self.cursor,
+            },
+            legacy_number_part,
+        })
+    }
+}
+
+/// Preserve the existing public token shapes, including greedy signed JSON
+/// numbers and single-character rejection of newer expression operators.
+pub(super) fn legacy(source: &str) -> Vec<super::TokenSpan> {
+    use super::{TokenClass, TokenSpan};
+    let mut scanner = Scanner::new(source).peekable();
+    let mut out = Vec::new();
+    while let Some(token) = scanner.next() {
+        let mut span = token.span;
+        let first = source.as_bytes()[span.start];
+        if first.is_ascii_digit() || matches!(first, b'+' | b'-' | b'.') {
+            while scanner
+                .peek()
+                .is_some_and(|next| next.legacy_number_part && next.span.start == span.end)
+            {
+                span.end = scanner.next().expect("peeked token").span.end;
+            }
+            let class = if serde_json::from_str::<serde_json::Number>(&source[span.start..span.end])
+                .is_ok()
+            {
+                TokenClass::Number
+            } else {
+                TokenClass::Error
+            };
+            out.push(TokenSpan { class, span });
+            continue;
+        }
+        let class = match token.class {
+            Class::Word => {
+                let word = &source[span.start..span.end];
+                if super::reserved(word) || matches!(word, "true" | "false" | "none") {
+                    TokenClass::Keyword
+                } else {
+                    TokenClass::Identifier
+                }
+            }
+            Class::String => TokenClass::String,
+            Class::Whitespace => TokenClass::Whitespace,
+            Class::Comment => TokenClass::Comment,
+            Class::Punctuation => {
+                // The raw scanner joins comparison operators. Legacy syntax
+                // classified their ASCII characters individually.
+                for at in span.start..span.end {
+                    let class = if b"{}();,[]:=@".contains(&source.as_bytes()[at]) {
+                        TokenClass::Punctuation
+                    } else {
+                        TokenClass::Error
+                    };
+                    out.push(TokenSpan {
+                        class,
+                        span: Span {
+                            start: at,
+                            end: at + 1,
+                        },
+                    });
+                }
+                continue;
+            }
+            Class::Error => TokenClass::Error,
+            Class::Number => unreachable!("number tokens start with a digit"),
+        };
+        out.push(TokenSpan { class, span });
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{TokenClass, tokenize};
+
+    #[test]
+    fn legacy_adapter_retains_authored_numeric_operator_and_trivia_tokens() {
+        use TokenClass::*;
+        let cases: &[(&str, &[(TokenClass, &str)])] = &[
+            (
+                "-1.5 1e-2 -0",
+                &[
+                    (Number, "-1.5"),
+                    (Whitespace, " "),
+                    (Number, "1e-2"),
+                    (Whitespace, " "),
+                    (Number, "-0"),
+                ],
+            ),
+            (
+                "1-2 1 -2 1 - 2",
+                &[
+                    (Error, "1-2"),
+                    (Whitespace, " "),
+                    (Number, "1"),
+                    (Whitespace, " "),
+                    (Number, "-2"),
+                    (Whitespace, " "),
+                    (Number, "1"),
+                    (Whitespace, " "),
+                    (Error, "-"),
+                    (Whitespace, " "),
+                    (Number, "2"),
+                ],
+            ),
+            (
+                "+1 .5 1_0 0x1 1e 1e+",
+                &[
+                    (Error, "+1"),
+                    (Whitespace, " "),
+                    (Error, ".5"),
+                    (Whitespace, " "),
+                    (Error, "1_0"),
+                    (Whitespace, " "),
+                    (Error, "0x1"),
+                    (Whitespace, " "),
+                    (Error, "1e"),
+                    (Whitespace, " "),
+                    (Error, "1e+"),
+                ],
+            ),
+            (
+                "<= != == >= / * $ !",
+                &[
+                    (Error, "<"),
+                    (Punctuation, "="),
+                    (Whitespace, " "),
+                    (Error, "!"),
+                    (Punctuation, "="),
+                    (Whitespace, " "),
+                    (Punctuation, "="),
+                    (Punctuation, "="),
+                    (Whitespace, " "),
+                    (Error, ">"),
+                    (Punctuation, "="),
+                    (Whitespace, " "),
+                    (Error, "/"),
+                    (Whitespace, " "),
+                    (Error, "*"),
+                    (Whitespace, " "),
+                    (Error, "$"),
+                    (Whitespace, " "),
+                    (Error, "!"),
+                ],
+            ),
+            (
+                "// π\r\n\"雪\" @alias",
+                &[
+                    (Comment, "// π\r"),
+                    (Whitespace, "\n"),
+                    (String, "\"雪\""),
+                    (Whitespace, " "),
+                    (Punctuation, "@"),
+                    (Keyword, "alias"),
+                ],
+            ),
+            ("\"incomplete 雪", &[(Error, "\"incomplete 雪")]),
+            ("\"bad\\q\"", &[(Error, "\"bad\\q\"")]),
+            (
+                "雪\u{b}a",
+                &[(Error, "雪"), (Error, "\u{b}"), (Identifier, "a")],
+            ),
+            (
+                "unit calculation quantity_kind if and List Number",
+                &[
+                    (Identifier, "unit"),
+                    (Whitespace, " "),
+                    (Identifier, "calculation"),
+                    (Whitespace, " "),
+                    (Identifier, "quantity_kind"),
+                    (Whitespace, " "),
+                    (Identifier, "if"),
+                    (Whitespace, " "),
+                    (Identifier, "and"),
+                    (Whitespace, " "),
+                    (Identifier, "List"),
+                    (Whitespace, " "),
+                    (Identifier, "Number"),
+                ],
+            ),
+        ];
+        for (source, expected) in cases {
+            let actual = tokenize(source);
+            assert_eq!(actual.len(), expected.len(), "{source:?}");
+            let mut offset = 0;
+            for (token, (class, spelling)) in actual.iter().zip(*expected) {
+                assert_eq!(token.class, *class, "{source:?} at {offset}");
+                assert_eq!(token.span.start, offset);
+                offset += spelling.len();
+                assert_eq!(token.span.end, offset);
+                assert_eq!(&source[token.span.start..token.span.end], *spelling);
+            }
+            assert_eq!(offset, source.len());
+        }
+    }
+}

crates/oa-core/src/language/source3_bridge.rs

@@ -0,0 +1,52 @@
+//! Convert only source3 lowering scratch state into its frozen migration input.
+//! This is not a current-to-legacy exporter: fields outside that scratch state
+//! must reject instead of being silently discarded.
+use crate::Project;
+use crate::persistence::{FileError, v3};
+use serde_json::{Map, Value};
+
+pub(super) fn from_scratch(
+    project: Project,
+    legacy_elements: Map<String, Value>,
+) -> Result<v3::Project3, FileError> {
+    // No `..`: a future Project field requires an explicit compatibility decision.
+    let Project {
+        schema_version,
+        id,
+        alias,
+        name,
+        description,
+        definitions,
+        elements,
+        relations,
+        diagrams,
+        artifact_links,
+        traces,
+    } = project;
+    if schema_version != 3 {
+        return Err(FileError::Invalid(
+            "Expected source3 lowering state.".into(),
+        ));
+    }
+    if !definitions.is_empty() || !elements.is_empty() {
+        return Err(FileError::Invalid(
+            "Source3 lowering state cannot contain current definitions or elements.".into(),
+        ));
+    }
+    Ok(v3::Project3 {
+        schema_version,
+        id,
+        alias,
+        name,
+        description,
+        elements: serde_json::from_value(Value::Object(legacy_elements))?,
+        // Keep the frozen nested contracts, including strict trace baselines.
+        relations: serde_json::from_value(serde_json::to_value(relations)?)?,
+        diagrams,
+        artifact_links,
+        traces: serde_json::from_value(serde_json::to_value(traces)?)?,
+    })
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/source3_bridge/tests.rs

@@ -0,0 +1,188 @@
+use super::*;
+use crate::{Id, language, persistence};
+use serde_json::json;
+
+const SOURCE3: &str = include_str!("../../../tests/fixtures/v3-data-contract.arcadia");
+const JSON3: &[u8] = include_bytes!("../../../tests/fixtures/v3-data-contract.json");
+const PROSE: &str = r#"arcadia 3;
+project review "Review" id "00000000-0000-0000-0000-000000000001" {
+    oa_activity reviewed_activity "Live OA" id "00000000-0000-0000-0000-000000000002" {}
+    sa_function function "Live SA" id "00000000-0000-0000-0000-000000000003" {}
+    trace review_link "Review link" id "00000000-0000-0000-0000-000000000004" {
+        oa @reviewed_activity; sa @function; kind Refinement;
+        baseline {
+            oa { name "Approved OA"; description "First\nΩ rationale"; };
+            sa { name "Approved SA"; description "Prior SA prose"; };
+        };
+    }
+}"#;
+
+fn id(value: u128) -> Id {
+    Id::from_u128(value)
+}
+
+fn prose_json() -> Value {
+    json!({
+        "schema_version":3,"id":id(1),"alias":"review","name":"Review","description":"",
+        "elements": {
+            id(2).to_string(): {"id":id(2),"alias":"reviewed_activity","name":"Live OA","description":"","parent":null,"body":{"Oa":"Activity"}},
+            id(3).to_string(): {"id":id(3),"alias":"function","name":"Live SA","description":"","parent":null,"body":{"Sa":"Function"}}
+        },
+        "relations":{},"diagrams":{},"artifact_links":{},
+        "traces": {id(4).to_string():{
+            "id":id(4),"alias":"review_link","name":"Review link","description":"",
+            "oa":id(2),"sa":id(3),"kind":"Refinement",
+            "baseline":{"oa":{"name":"Approved OA","description":"First\nΩ rationale"},"sa":{"name":"Approved SA","description":"Prior SA prose"}}
+        }}
+    })
+}
+
+#[test]
+fn frozen_source3_and_json3_have_complete_model_and_migration_parity() {
+    let source = language::parse_with_report(SOURCE3).unwrap();
+    let json = persistence::decode_with_report(JSON3).unwrap();
+    assert_eq!(source.project, json.project);
+    assert_eq!(source.migration, json.migration);
+    assert!(source.project.definitions.is_empty());
+    let report = source.migration.unwrap();
+    assert_eq!(
+        (report.from_schema, report.to_schema),
+        (3, crate::SCHEMA_VERSION)
+    );
+    // This tests direct legacy lowering. Canonical source8 reopening remains a
+    // separate, unchanged public integration gate.
+}
+
+#[test]
+fn frozen_wire_still_rejects_new_unknown_and_duplicate_fields() {
+    let original: Value = serde_json::from_slice(JSON3).unwrap();
+    for definitions in [
+        json!({}),
+        Value::Null,
+        json!({id(90).to_string(): {"name":"new"}}),
+    ] {
+        let mut bad = original.clone();
+        bad["definitions"] = definitions;
+        let error = persistence::decode(&serde_json::to_vec(&bad).unwrap())
+            .err()
+            .unwrap()
+            .to_string();
+        assert!(error.contains("unknown field `definitions`"), "{error}");
+    }
+    let mut bad = original;
+    bad["unrecognized"] = json!(true);
+    assert!(
+        persistence::decode(&serde_json::to_vec(&bad).unwrap())
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("unknown field `unrecognized`")
+    );
+    let raw = std::str::from_utf8(JSON3).unwrap();
+    let duplicate = raw.replacen(
+        "\"schema_version\": 3",
+        "\"schema_version\": 3, \"schema_version\": 3",
+        1,
+    );
+    assert_ne!(duplicate, raw);
+    assert!(
+        persistence::decode(duplicate.as_bytes())
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("duplicate")
+    );
+}
+
+#[test]
+fn old_review_prose_survives_without_admitting_semantic_fields() {
+    let source = language::parse_with_report(PROSE).unwrap();
+    let json =
+        persistence::decode_with_report(&serde_json::to_vec(&prose_json()).unwrap()).unwrap();
+    assert_eq!(source.project, json.project);
+    assert_eq!(source.migration, json.migration);
+    let baseline = source.project.traces[&id(4)].baseline.as_ref().unwrap();
+    assert_eq!(baseline.oa.name, "Approved OA");
+    assert_eq!(baseline.oa.description, "First\nΩ rationale");
+    assert_eq!(baseline.sa.description, "Prior SA prose");
+    assert!(baseline.semantic.is_none());
+    for semantic in [Value::Null, json!({"facets":[]})] {
+        let mut bad = prose_json();
+        bad["traces"][id(4).to_string()]["baseline"]["semantic"] = semantic;
+        let error = persistence::decode(&serde_json::to_vec(&bad).unwrap())
+            .err()
+            .unwrap()
+            .to_string();
+        assert!(error.contains("semantic"), "{error}");
+    }
+    for field in ["semantic none;", "semantic { facets []; };"] {
+        let bad = PROSE.replace("baseline {", &format!("baseline {{ {field}"));
+        let errors = language::parse(&bad).err().unwrap();
+        assert!(
+            errors
+                .iter()
+                .any(|e| e.message.contains("require schema/source5")),
+            "{errors:?}"
+        );
+    }
+}
+
+#[test]
+fn scratch_bridge_refuses_to_discard_current_only_data() {
+    let mut empty = Project::empty();
+    empty.schema_version = 3;
+    assert!(from_scratch(empty.clone(), Map::new()).is_ok());
+    let mut wrong_version = empty.clone();
+    wrong_version.schema_version = crate::SCHEMA_VERSION;
+    assert!(from_scratch(wrong_version, Map::new()).is_err());
+    let mut definition = empty;
+    definition.definitions.insert(
+        id(90),
+        crate::analysis::Definition {
+            id: id(90),
+            alias: "dimensionless".into(),
+            name: "Dimensionless".into(),
+            description: String::new(),
+            body: crate::analysis::DefinitionBody::QuantityKind(
+                crate::analysis::QuantityKindDefinition {
+                    dimension: crate::analysis_numeric::Dimension::ZERO,
+                    algebra: crate::analysis::QuantityAlgebra::Linear,
+                },
+            ),
+        },
+    );
+    assert!(
+        from_scratch(definition, Map::new())
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("definitions or elements")
+    );
+    let mut current = persistence::decode_with_report(&serde_json::to_vec(&prose_json()).unwrap())
+        .unwrap()
+        .project;
+    current.schema_version = 3;
+    assert!(
+        from_scratch(current.clone(), Map::new())
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("definitions or elements")
+    );
+    current.elements.clear();
+    current
+        .traces
+        .get_mut(&id(4))
+        .unwrap()
+        .baseline
+        .as_mut()
+        .unwrap()
+        .semantic = Some(crate::semantic::SemanticBaseline { facets: Vec::new() });
+    assert!(
+        from_scratch(current, Map::new())
+            .err()
+            .unwrap()
+            .to_string()
+            .contains("semantic")
+    );
+}

crates/oa-core/src/language_outline_tests.rs

@@ -1,386 +0,0 @@
-//! Prepared outline tests. Explicit compatibility tests additionally exercise
-//! the existing parsers/analyze; the outline entry itself never calls them.
-use super::*;
-
-fn limits() -> OutlineLimits {
-    OutlineLimits {
-        max_source_bytes: 1024 * 1024,
-        max_tokens: 100_000,
-        max_declarations: 1_000,
-    }
-}
-
-fn declaration<'a>(result: &'a Outline<'_>, alias: &str) -> &'a OutlineDeclaration {
-    result
-        .declarations
-        .iter()
-        .find(|d| d.declaration.alias == alias)
-        .unwrap()
-}
-
-fn text(source: &str, span: Span) -> &str {
-    &source[span.start..span.end]
-}
-
-#[test]
-fn outline_roles_preserve_unicode_crlf_and_exact_escaped_uuid_literal() {
-    let source = "// 検査 🚒\r\noa_actor responder \"救助\" id \"\\u00300000000-0000-0000-0000-000000000001\" {}\r\nsource @ // 使用\r\n responder;";
-    let before = source.as_bytes().to_vec();
-    let result = outline(source, limits()).unwrap();
-    assert_eq!(result.source.as_bytes(), before);
-    assert_eq!(result.source.as_ptr(), source.as_ptr());
-    let d = declaration(&result, "responder");
-    assert_eq!(text(source, d.kind_span), "oa_actor");
-    assert_eq!(text(source, d.alias_span), "responder");
-    assert_eq!(
-        text(source, d.id_literal_span.unwrap()),
-        "\"\\u00300000000-0000-0000-0000-000000000001\""
-    );
-    assert_eq!(d.declaration.id, Some(Id::from_u128(1)));
-    assert_eq!(d.declaration.span.start, source.find("oa_actor").unwrap());
-    assert_eq!(d.declaration.span.end, source.find("{}\r\n").unwrap() + 2);
-    let mut end = 0;
-    for token in &result.tokens {
-        assert_eq!(token.span.start, end);
-        assert!(token.span.start < token.span.end);
-        assert!(source.is_char_boundary(token.span.start));
-        assert!(source.is_char_boundary(token.span.end));
-        end = token.span.end;
-    }
-    assert_eq!(end, source.len());
-    assert!(!result.has_lexical_errors);
-    assert!(!result.has_unmatched_braces);
-}
-
-#[test]
-fn closed_id_at_eof_is_inside_the_declaration_extent() {
-    for source in [
-        "oa_actor a \"Actor\" id \"00000000-0000-0000-0000-000000000001\"",
-        "node placed id \"00000000-0000-0000-0000-000000000001\"",
-    ] {
-        let result = outline(source, limits()).unwrap();
-        let d = &result.declarations[0];
-        let literal = d.id_literal_span.unwrap();
-        assert_eq!(d.declaration.id, Some(Id::from_u128(1)));
-        assert_eq!(d.declaration.span.end, source.len());
-        assert!(d.declaration.span.start <= literal.start);
-        assert!(literal.end <= d.declaration.span.end);
-    }
-    for source in ["oa_actor a \"Actor\"", "oa_actor a \"Actor\" id"] {
-        let result = outline(source, limits()).unwrap();
-        let d = &result.declarations[0];
-        assert_eq!(d.declaration.span.end, source.len());
-        assert_eq!(d.declaration.id, None);
-        assert_eq!(d.id_literal_span, None);
-    }
-}
-
-#[test]
-fn missing_bad_and_historical_ids_never_allocate_authored_identity() {
-    let source = "oa_actor missing \"No ID\" {}\noa_actor bad \"Bad ID\" id \"not-a-uuid\" {}\noa_actor historical \"00000000-0000-0000-0000-000000000001\" { history uuid \"00000000-0000-0000-0000-000000000001\"; }";
-    let first = outline(source, limits()).unwrap();
-    let second = outline(source, limits()).unwrap();
-    assert_eq!(first, second);
-    assert!(
-        first
-            .declarations
-            .iter()
-            .all(|d| d.declaration.id.is_none())
-    );
-    assert_eq!(declaration(&first, "missing").id_literal_span, None);
-    assert_eq!(declaration(&first, "historical").id_literal_span, None);
-    assert_eq!(
-        text(source, declaration(&first, "bad").id_literal_span.unwrap()),
-        "\"not-a-uuid\""
-    );
-    // Balanced tokens are not a successful syntax/semantic validation claim.
-    assert!(!first.has_lexical_errors);
-    assert!(!first.has_unmatched_braces);
-}
-
-#[test]
-fn invalid_full_scan_keeps_closed_children_and_reports_lexical_body_facts() {
-    let source = "oa_entity outer \"Outer\" {\n oa_actor ready \"Ready\" { description \"} stays text\"; }\n oa_actor pending \"Pending\" { description \"unfinished 🌊";
-    let result = outline(source, limits()).unwrap();
-    assert_eq!(result.source, source);
-    assert_eq!(result.tokens.last().unwrap().span.end, source.len());
-    assert!(result.has_lexical_errors);
-    assert!(result.has_unmatched_braces);
-    let ready = declaration(&result, "ready");
-    assert_eq!(
-        text(source, ready.declaration.span),
-        "oa_actor ready \"Ready\" { description \"} stays text\"; }"
-    );
-    assert_eq!(
-        declaration(&result, "outer").declaration.span.end,
-        source.len()
-    );
-    assert_eq!(
-        declaration(&result, "pending").declaration.span.end,
-        source.len()
-    );
-    let unmatched_close = outline("}\n// brace in comment {\n", limits()).unwrap();
-    assert!(unmatched_close.has_unmatched_braces);
-    assert!(!unmatched_close.has_lexical_errors);
-}
-
-#[test]
-fn missing_body_syntax_is_unchecked_even_when_known_error_flags_are_clear() {
-    let source = "oa_actor a \"A\" id \"00000000-0000-0000-0000-000000000001\"";
-    let result = outline(source, limits()).unwrap();
-    assert_eq!(result.declarations.len(), 1);
-    assert!(!result.has_lexical_errors);
-    assert!(!result.has_unmatched_braces);
-    // There is deliberately no `valid` flag: the known-complete fact is scanning
-    // these bytes, not the missing body becoming legal or the draft being applied.
-    assert_eq!(result.source, source);
-}
-
-#[test]
-fn keyword_alias_and_collisions_keep_every_source_ordered_header() {
-    let source = "project root_model \"Model\" {\n oa_actor oa_activity \"First\" id \"00000000-0000-0000-0000-000000000001\" {}\n oa_actor oa_activity \"Second\" id \"00000000-0000-0000-0000-000000000001\" {}\n diagram view_one \"View\" {}\n node placement { diagram @view_one; }\n}";
-    let result = outline(source, limits()).unwrap();
-    assert_eq!(result.declarations.len(), 5);
-    let duplicates: Vec<_> = result
-        .declarations
-        .iter()
-        .filter(|d| d.declaration.alias == "oa_activity")
-        .collect();
-    assert_eq!(duplicates.len(), 2);
-    assert!(duplicates[0].alias_span.start < duplicates[1].alias_span.start);
-    assert_eq!(duplicates[0].declaration.id, duplicates[1].declaration.id);
-    assert!(
-        result
-            .tokens
-            .iter()
-            .any(|t| t.span == duplicates[0].alias_span && t.class == TokenClass::Keyword)
-    );
-    assert_eq!(
-        text(source, declaration(&result, "placement").kind_span),
-        "node"
-    );
-    assert_eq!(declaration(&result, "placement").declaration.id, None);
-}
-
-#[test]
-fn bounds_refuse_before_returning_a_partial_outline() {
-    let source = "oa_actor a \"A\" {}\noa_actor b \"B\" {}";
-    let admitted = outline(source, limits()).unwrap();
-    let exact = OutlineLimits {
-        max_source_bytes: source.len(),
-        max_tokens: admitted.tokens.len(),
-        max_declarations: 2,
-    };
-    assert_eq!(outline(source, exact).unwrap(), admitted);
-    for resource in [
-        OutlineResource::SourceBytes,
-        OutlineResource::Tokens,
-        OutlineResource::Declarations,
-    ] {
-        let mut lower = exact;
-        match resource {
-            OutlineResource::SourceBytes => lower.max_source_bytes -= 1,
-            OutlineResource::Tokens => lower.max_tokens -= 1,
-            OutlineResource::Declarations => lower.max_declarations -= 1,
-        }
-        let error = outline(source, lower).unwrap_err();
-        assert_eq!(error.resource, resource);
-        assert!(error.observed_at_least > error.limit);
-        assert!(source.is_char_boundary(error.offset));
-        if resource == OutlineResource::Declarations {
-            assert_eq!(error.offset, source.find("oa_actor b").unwrap());
-        }
-    }
-    let empty = outline(
-        "",
-        OutlineLimits {
-            max_source_bytes: 0,
-            max_tokens: 0,
-            max_declarations: 0,
-        },
-    )
-    .unwrap();
-    assert!(empty.tokens.is_empty() && empty.declarations.is_empty());
-    let unicode = "// 🌊\r\noa_actor a \"A\" {}";
-    let error = outline(
-        unicode,
-        OutlineLimits {
-            max_source_bytes: 4,
-            ..limits()
-        },
-    )
-    .unwrap_err();
-    assert_eq!(error.resource, OutlineResource::SourceBytes);
-    assert_eq!(error.offset, 0);
-    let error = outline(
-        unicode,
-        OutlineLimits {
-            max_tokens: 1,
-            ..limits()
-        },
-    )
-    .unwrap_err();
-    assert_eq!(error.resource, OutlineResource::Tokens);
-    assert_eq!(error.offset, unicode.find('\n').unwrap());
-}
-
-#[test]
-fn outline_ranges_follow_current_bytes_without_identity_stabilization() {
-    let old = "oa_actor a \"A\" {}\nsource @a;";
-    let current = format!("// 航海 🚒\r\n{old}");
-    let old_outline = outline(old, limits()).unwrap();
-    let current_outline = outline(&current, limits()).unwrap();
-    let shift = current.len() - old.len();
-    let old_role = &old_outline.declarations[0];
-    let current_role = &current_outline.declarations[0];
-    assert_eq!(
-        current_role.alias_span.start,
-        old_role.alias_span.start + shift
-    );
-    assert_eq!(
-        current_role.kind_span.start,
-        old_role.kind_span.start + shift
-    );
-    assert_eq!(
-        current_role.declaration.span.end,
-        old_role.declaration.span.end + shift
-    );
-    assert_eq!(current_outline.source, current);
-    assert_eq!(old_outline.source, old);
-    assert_eq!(current_role.declaration.id, None);
-    assert!(!current_outline.source.contains(" id "));
-    // Workspace revision/stale-handle rejection belongs to the query/adapter,
-    // not a claim that an old owned span can be applied to any other string.
-}
-
-#[test]
-fn deeply_nested_bounds_use_the_same_iterative_walk_and_declaration_budget() {
-    let mut source = String::new();
-    for index in 0..600 {
-        source.push_str(&format!("oa_activity work_{index} \"Work\" {{\n"));
-    }
-    source.push_str(&"}\n".repeat(600));
-    let result = outline(&source, limits()).unwrap();
-    assert_eq!(result.declarations.len(), 600);
-    assert!(!result.has_unmatched_braces);
-    assert_eq!(
-        result.declarations[0].declaration.span.end,
-        source.len() - 1
-    );
-    let error = outline(
-        &source,
-        OutlineLimits {
-            max_declarations: 599,
-            ..limits()
-        },
-    )
-    .unwrap_err();
-    assert_eq!(error.resource, OutlineResource::Declarations);
-    assert_eq!(error.observed_at_least, 600);
-    assert_eq!(error.offset, source.find("oa_activity work_599").unwrap());
-}
-
-#[test]
-fn noncanonical_uuid_spellings_have_no_outline_or_analysis_identity() {
-    for raw in [
-        "00000000000000000000000000000001",
-        "{00000000-0000-0000-0000-000000000001}",
-        "urn:uuid:00000000-0000-0000-0000-000000000001",
-    ] {
-        assert!(
-            Id::parse_str(raw).is_ok(),
-            "The UUID crate alone is too permissive"
-        );
-        assert!(!has_uuid_header_shape(raw));
-        let literal = format!("\"{raw}\"");
-        let modern = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
-        let before = modern.clone();
-        let result = outline(&modern, limits()).unwrap();
-        let d = declaration(&result, "model");
-        assert_eq!(d.declaration.id, None);
-        assert_eq!(text(&modern, d.id_literal_span.unwrap()), literal);
-        assert_eq!(modern, before);
-        let errors = parse(&modern).unwrap_err();
-        assert!(
-            errors
-                .iter()
-                .any(|error| error.message.contains("8-4-4-4-12")
-                    && error.span.start == modern.find(&literal).unwrap())
-        );
-        // Intentional compatibility correction: old analyze yielded Some(Id(1))
-        // here despite lint rejecting the header. It now shares outline's None.
-        let analysis = analyze(&modern);
-        assert_eq!(
-            analysis
-                .declarations
-                .iter()
-                .find(|d| d.alias == "model")
-                .unwrap()
-                .id,
-            None
-        );
-        assert!(
-            analysis
-                .diagnostics
-                .iter()
-                .any(|error| error.message.contains("8-4-4-4-12"))
-        );
-        let legacy_source = format!("arcadia 1; project \"Legacy\" id {literal} {{}}");
-        let legacy_errors = legacy::parse(&legacy_source).unwrap_err();
-        assert!(
-            legacy_errors
-                .iter()
-                .any(|error| error.message.contains("8-4-4-4-12"))
-        );
-    }
-}
-
-#[test]
-fn uppercase_and_json_escaped_header_ids_survive_both_parsers_and_outline() {
-    let expected = Id::from_u128(0xabcdef);
-    let canonical = expected.to_string();
-    let uppercase = canonical.to_uppercase();
-    assert_ne!(uppercase, canonical);
-    for raw in [uppercase.clone(), format!("\\u0030{}", &uppercase[1..])] {
-        let literal = format!("\"{raw}\"");
-        let decoded: String = serde_json::from_str(&literal).unwrap();
-        assert!(has_uuid_header_shape(&decoded));
-        let modern = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
-        let result = outline(&modern, limits()).unwrap();
-        let d = declaration(&result, "model");
-        assert_eq!(d.declaration.id, Some(expected));
-        assert_eq!(text(&modern, d.id_literal_span.unwrap()), literal);
-        assert_eq!(result.source.as_bytes(), modern.as_bytes());
-        assert_eq!(parse(&modern).unwrap().id, expected);
-        let analysis = analyze(&modern);
-        assert_eq!(analysis.declarations[0].id, Some(expected));
-        assert!(
-            !analysis
-                .diagnostics
-                .iter()
-                .any(|error| error.severity == crate::validation::Severity::Error)
-        );
-        let legacy_source = format!("arcadia 1; project \"Legacy\" id {literal} {{}}");
-        assert_eq!(legacy::parse(&legacy_source).unwrap().id, expected);
-    }
-}
-
-#[test]
-fn header_shape_still_requires_valid_hexadecimal_uuid_data() {
-    let raw = "00000000-0000-0000-0000-00000000000Z";
-    assert!(has_uuid_header_shape(raw));
-    assert!(Id::parse_str(raw).is_err());
-    let literal = format!("\"{raw}\"");
-    let source = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
-    let result = outline(&source, limits()).unwrap();
-    let d = declaration(&result, "model");
-    assert_eq!(d.declaration.id, None);
-    assert_eq!(text(&source, d.id_literal_span.unwrap()), literal);
-    assert!(
-        parse(&source)
-            .unwrap_err()
-            .iter()
-            .any(|error| error.message == "Invalid UUID identity.")
-    );
-    assert_eq!(analyze(&source).declarations[0].id, None);
-}

crates/oa-core/src/lib.rs

@@ -1,4 +1,6 @@
 //! Framework-independent OA/SA model, transactional commands and editing services.
+pub mod analysis;
+pub mod analysis_numeric;
 pub mod data;
 pub mod language;
 pub mod model;
@@ -10,7 +12,6 @@ pub mod references;
 pub mod routing;
 pub mod semantic;
 pub mod session;
-mod source_defaults;
 pub mod source_files;
 pub mod source_project;
 pub mod topology_context;

crates/oa-core/src/migration_v4.rs

@@ -75,6 +75,7 @@ impl Project4 {
             alias: self.alias,
             name: self.name,
             description: self.description,
+            definitions: BTreeMap::new(),
             elements: self.elements,
             relations: self.relations,
             diagrams: self.diagrams,

crates/oa-core/src/migration_v7.rs

@@ -0,0 +1,62 @@
+//! Frozen schema5/6/7 top-level envelope. No schema8 definition catalog/defaults.
+//! Unchanged nested records are shared only after the closed old-kind check.
+use crate::persistence::FileError;
+use crate::*;
+use serde::Deserialize;
+use std::collections::BTreeMap;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct Project7 {
+    pub schema_version: u32,
+    pub id: Id,
+    pub alias: String,
+    pub name: String,
+    pub description: String,
+    #[serde(deserialize_with = "crate::unique_id_map")]
+    pub elements: BTreeMap<Id, Element>,
+    #[serde(deserialize_with = "crate::unique_id_map")]
+    pub relations: BTreeMap<Id, Relation>,
+    #[serde(deserialize_with = "crate::unique_id_map")]
+    pub diagrams: BTreeMap<Id, Diagram>,
+    #[serde(deserialize_with = "crate::unique_id_map")]
+    pub artifact_links: BTreeMap<Id, ArtifactLink>,
+    #[serde(deserialize_with = "crate::unique_id_map")]
+    pub traces: BTreeMap<Id, Trace>,
+}
+impl Project7 {
+    pub(crate) fn into_current(self) -> Result<Project, FileError> {
+        if !(5..=7).contains(&self.schema_version) {
+            return Err(FileError::Invalid(
+                "Expected frozen schema5, 6 or 7.".into(),
+            ));
+        }
+        reject_elements(self.elements.values())?;
+        Ok(Project {
+            schema_version: self.schema_version,
+            id: self.id,
+            alias: self.alias,
+            name: self.name,
+            description: self.description,
+            definitions: BTreeMap::new(),
+            elements: self.elements,
+            relations: self.relations,
+            diagrams: self.diagrams,
+            artifact_links: self.artifact_links,
+            traces: self.traces,
+        })
+    }
+}
+pub(crate) fn reject_elements<'a>(
+    elements: impl Iterator<Item = &'a Element>,
+) -> Result<(), FileError> {
+    for element in elements {
+        if element.kind().is_analysis() {
+            return Err(FileError::Invalid(format!(
+                "{:?} requires schema/source 8.",
+                element.kind()
+            )));
+        }
+    }
+    Ok(())
+}

crates/oa-core/src/model.rs

@@ -6,7 +6,7 @@ use std::{
 use uuid::Uuid;
 
 pub type Id = Uuid;
-pub const SCHEMA_VERSION: u32 = 7;
+pub const SCHEMA_VERSION: u32 = 8;
 pub const MAX_COORDINATE: f32 = 1_000_000.;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
@@ -64,9 +64,12 @@ pub enum Kind {
     Terminate,
     Event,
     Constraint,
+    EngineeringProperty,
+    AnalysisCase,
+    AnalysisCheck,
 }
 impl Kind {
-    pub const ALL: [Self; 39] = [
+    pub const ALL: [Self; 42] = [
         Self::Entity,
         Self::Actor,
         Self::Role,
@@ -106,6 +109,9 @@ impl Kind {
         Self::Terminate,
         Self::Event,
         Self::Constraint,
+        Self::EngineeringProperty,
+        Self::AnalysisCase,
+        Self::AnalysisCheck,
     ];
     pub fn label(self) -> &'static str {
         match self {
@@ -148,6 +154,9 @@ impl Kind {
             Self::Terminate => "Terminate",
             Self::Event => "Event",
             Self::Constraint => "Constraint",
+            Self::EngineeringProperty => "Engineering property",
+            Self::AnalysisCase => "Analysis case",
+            Self::AnalysisCheck => "Analysis check",
         }
     }
     pub fn is_performer(self) -> bool {
@@ -156,6 +165,9 @@ impl Kind {
             Self::Entity | Self::Actor | Self::System | Self::SystemActor
         )
     }
+    pub fn is_analysis(self) -> bool {
+        matches!(self, Self::EngineeringProperty | Self::AnalysisCase | Self::AnalysisCheck)
+    }
     pub fn is_work(self) -> bool {
         matches!(self, Self::Activity | Self::Function)
     }
@@ -652,6 +664,23 @@ pub enum SharedBody {
         expression: String,
         constrained: Vec<Id>,
     },
+    EngineeringProperty {
+        subject: crate::analysis::AnalysisSubject,
+        value_type: crate::analysis::AnalysisType,
+        display_unit: Option<crate::analysis::DefinitionRef>,
+        base: crate::analysis::Binding,
+    },
+    AnalysisCase {
+        subject: Option<crate::analysis::AnalysisSubject>,
+        base: crate::analysis::BaselineBase,
+        #[serde(deserialize_with = "unique_id_map")]
+        overrides: BTreeMap<Id, crate::analysis::Binding>,
+    },
+    AnalysisCheck {
+        subject: Option<crate::analysis::AnalysisSubject>,
+        documented_constraint: Option<Id>,
+        predicate: crate::analysis::Binding,
+    },
 }
 impl Element {
     pub fn layer(&self) -> Layer {
@@ -752,7 +781,8 @@ impl ElementBody {
         }
     }
     pub fn new(kind: Kind, layer: Layer) -> Option<Self> {
-        if !kind.supports(layer) {
+        // Analysis creation requires explicitly authored types and bindings.
+        if !kind.supports(layer) || kind.is_analysis() {
             return None;
         }
         Some(match kind {
@@ -864,6 +894,9 @@ impl SharedBody {
             Self::Region => Kind::Region,
             Self::State { kind, .. } => kind.kind(),
             Self::Constraint { .. } => Kind::Constraint,
+            Self::EngineeringProperty { .. } => Kind::EngineeringProperty,
+            Self::AnalysisCase { .. } => Kind::AnalysisCase,
+            Self::AnalysisCheck { .. } => Kind::AnalysisCheck,
         }
     }
 }
@@ -1625,6 +1658,8 @@ pub struct Project {
     pub name: String,
     pub description: String,
     #[serde(deserialize_with = "unique_id_map")]
+    pub definitions: BTreeMap<Id, crate::analysis::Definition>,
+    #[serde(deserialize_with = "unique_id_map")]
     pub elements: BTreeMap<Id, Element>,
     #[serde(deserialize_with = "unique_id_map")]
     pub relations: BTreeMap<Id, Relation>,
@@ -1717,6 +1752,7 @@ impl Project {
             alias: "mission".into(),
             name: "Untitled mission".into(),
             description: String::new(),
+            definitions: BTreeMap::new(),
             elements: BTreeMap::new(),
             relations: BTreeMap::new(),
             diagrams: BTreeMap::new(),
@@ -1726,6 +1762,7 @@ impl Project {
     }
     pub fn identities(&self) -> Vec<(Id, &str)> {
         let mut out = vec![(self.id, self.alias.as_str())];
+        out.extend(self.definitions.values().map(|v| (v.id, v.alias.as_str())));
         out.extend(self.elements.values().map(|v| (v.id, v.alias.as_str())));
         out.extend(self.relations.values().map(|v| (v.id, v.alias.as_str())));
         out.extend(self.diagrams.values().map(|v| (v.id, v.alias.as_str())));
@@ -1783,6 +1820,9 @@ impl Project {
         if id == self.id {
             return &self.name;
         }
+        if let Some(v) = self.definitions.get(&id) {
+            return &v.name;
+        }
         if let Some(v) = self.elements.get(&id) {
             return &v.name;
         }

crates/oa-core/src/persistence.rs

@@ -2,6 +2,10 @@ use crate::*;
 use serde::{Deserialize, Serialize};
 use std::{io::Write, path::Path};
 use thiserror::Error;
+mod json_codec;
+#[cfg(test)]
+#[path = "persistence/source_save_tests.rs"]
+mod source_save_tests;
 #[path = "migration_v2/mod.rs"]
 pub(crate) mod v2;
 pub(crate) use v2::adapter::migrate as migrate_v2_limited;
@@ -9,6 +13,8 @@ pub(crate) use v2::adapter::migrate as migrate_v2_limited;
 pub(crate) mod v3;
 #[path = "migration_v4.rs"]
 pub(crate) mod v4;
+#[path = "migration_v7.rs"]
+pub(crate) mod v7;
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -130,6 +136,19 @@ pub fn decode_limited(
 pub fn decode_with_report_limited(
     bytes: &[u8],
     limits: crate::language::ParseLimits,
+) -> Result<DecodeResult, FileError> {
+    decode_with_report_profile(
+        bytes,
+        limits,
+        json_codec::Profile::with_byte_limit(limits.max_source_bytes),
+        json_codec::DEPTH_128_VALIDATED,
+    )
+}
+fn decode_with_report_profile(
+    bytes: &[u8],
+    limits: crate::language::ParseLimits,
+    profile: json_codec::Profile,
+    depth_128: bool,
 ) -> Result<DecodeResult, FileError> {
     if bytes.len() > limits.max_source_bytes {
         return Err(FileError::Limit(format!(
@@ -138,65 +157,43 @@ pub fn decode_with_report_limited(
         )));
     }
     let decoded = if bytes.iter().find(|b| !b.is_ascii_whitespace()) == Some(&b'{') {
-        let header: serde_json::Value = serde_json::from_slice(bytes)?;
-        if header
-            .get("schema_version")
-            .and_then(serde_json::Value::as_u64)
-            .is_some_and(|v| v <= 6)
-        {
-            reject_source7_fields(&header).map_err(FileError::Invalid)?;
+        json_codec::preflight(bytes, profile)?;
+        let version = json_codec::version(bytes)?;
+        if version.is_some_and(|version| version <= 6) {
+            let header = json_codec::legacy(bytes)?;
+            let result = check_legacy_header(&header, version);
+            json_codec::discard_value(header);
+            result?;
         }
-        if header
-            .get("schema_version")
-            .and_then(serde_json::Value::as_u64)
-            .is_some_and(|v| v <= 5)
-            && let Some(diagrams) = header
-                .get("diagrams")
-                .and_then(serde_json::Value::as_object)
-        {
-            for diagram in diagrams.values().filter_map(serde_json::Value::as_object) {
-                for key in diagram.keys() {
-                    if key == "view_options" {
-                        return Err(FileError::Invalid("Diagram.view_options requires schema/source 6, including an explicitly supplied default value.".into()));
-                    }
-                    if !matches!(
-                        key.as_str(),
-                        "id" | "alias"
-                            | "name"
-                            | "description"
-                            | "layer"
-                            | "projection"
-                            | "nodes"
-                            | "routes"
-                    ) {
-                        return Err(FileError::Invalid(format!(
-                            "Unknown diagram field '{key}' in the frozen pre6 contract."
-                        )));
-                    }
-                }
-            }
-        }
-        match header
-            .get("schema_version")
-            .and_then(serde_json::Value::as_u64)
-        {
+        match version {
             Some(1) => {
-                let old = serde_json::from_slice(bytes)?;
+                let old = json_codec::legacy(bytes)?;
                 check_v1_limits(&old, limits).map_err(FileError::Limit)?;
                 migrate_v1_with_report_limited(old, limits)?
             }
-            Some(2) => migrate_v2_limited(serde_json::from_slice(bytes)?, limits)?,
-            Some(3) => v3::migrate(serde_json::from_slice(bytes)?, limits)?,
-            Some(4) => v4::migrate(serde_json::from_slice(bytes)?, limits)?,
-            Some(5) => migrate_v5(serde_json::from_slice(bytes)?, limits)?,
-            Some(6) => migrate_v6(serde_json::from_slice(bytes)?, limits)?,
-            Some(7) => DecodeResult {
-                project: serde_json::from_slice(bytes)?,
+            Some(2) => migrate_v2_limited(json_codec::legacy(bytes)?, limits)?,
+            Some(3) => v3::migrate(json_codec::legacy(bytes)?, limits)?,
+            Some(4) => v4::migrate(json_codec::legacy(bytes)?, limits)?,
+            Some(5) => migrate_v5(
+                json_codec::legacy::<v7::Project7>(bytes)?.into_current()?,
+                limits,
+            )?,
+            Some(6) => migrate_v6(
+                json_codec::legacy::<v7::Project7>(bytes)?.into_current()?,
+                limits,
+            )?,
+            Some(7) => migrate_v7(
+                json_codec::legacy::<v7::Project7>(bytes)?.into_current()?,
+                limits,
+            )?,
+            Some(8) => DecodeResult {
+                project: json_codec::current(bytes, profile, depth_128)?,
                 migration: None,
             },
             _ => {
                 return Err(FileError::Invalid(
-                    "Unsupported or missing schema_version; expected 1, 2, 3, 4, 5, 6 or 7.".into(),
+                    "Unsupported or missing schema_version; expected 1, 2, 3, 4, 5, 6, 7 or 8."
+                        .into(),
                 ));
             }
         }
@@ -225,6 +222,38 @@ pub fn decode_with_report_limited(
     Ok(decoded)
 }
 
+fn check_legacy_header(header: &serde_json::Value, version: Option<u64>) -> Result<(), FileError> {
+    reject_source7_fields(header).map_err(FileError::Invalid)?;
+    if version.is_some_and(|version| version <= 5)
+        && let Some(diagrams) = header
+            .get("diagrams")
+            .and_then(serde_json::Value::as_object)
+    {
+        for diagram in diagrams.values().filter_map(serde_json::Value::as_object) {
+            for key in diagram.keys() {
+                if key == "view_options" {
+                    return Err(FileError::Invalid("Diagram.view_options requires schema/source 6, including an explicitly supplied default value.".into()));
+                }
+                if !matches!(
+                    key.as_str(),
+                    "id" | "alias"
+                        | "name"
+                        | "description"
+                        | "layer"
+                        | "projection"
+                        | "nodes"
+                        | "routes"
+                ) {
+                    return Err(FileError::Invalid(format!(
+                        "Unknown diagram field '{key}' in the frozen pre6 contract."
+                    )));
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
 /// Versions 4 and 5 share unchanged typed records, but their constructor set
 /// remains frozen. Apply this before normalizing the advertised version.
 pub(crate) fn pre6_relation_kind(kind: RelationKind) -> bool {
@@ -348,6 +377,7 @@ pub(crate) fn migrate_v5(
     if project.schema_version != 5 {
         return Err(FileError::Invalid("Expected schema_version 5.".into()));
     }
+    reject_pre8_project(&project)?;
     check_pre6_relations(project.relations.values())?;
     check_pre6_elements(project.elements.values())?;
     for baseline in project
@@ -368,48 +398,49 @@ pub(crate) fn migrate_v5(
 /// Reject explicit new fields before serde defaults can erase their presence.
 /// This is also applied to source's resolved structured values.
 pub(crate) fn reject_source7_fields(value: &serde_json::Value) -> Result<(), String> {
-    match value {
-        serde_json::Value::Object(fields) => {
-            if fields.contains_key("ContextualLink") {
-                return Err("ContextualLink requires schema/source 7.".into());
+    let mut pending = vec![value];
+    while let Some(value) = pending.pop() {
+        match value {
+            serde_json::Value::Object(fields) => {
+                if fields.contains_key("ContextualLink") {
+                    return Err("ContextualLink requires schema/source 7.".into());
+                }
+                if fields.get("Relation").and_then(serde_json::Value::as_str)
+                    == Some("ContextualLink")
+                {
+                    return Err("ContextualLink view selectors require schema/source 7.".into());
+                }
+                if fields.keys().any(|key| {
+                    matches!(
+                        key.as_str(),
+                        "Operation"
+                            | "ContextOwner"
+                            | "ContextSource"
+                            | "ContextTarget"
+                            | "ContextPurpose"
+                    )
+                }) {
+                    return Err(
+                        "Operation/contextual-link semantic facets require schema/source 7.".into(),
+                    );
+                }
+                if fields
+                    .get("Exchange")
+                    .and_then(serde_json::Value::as_object)
+                    .is_some_and(|body| body.contains_key("operation"))
+                {
+                    return Err(
+                        "Exchange.operation requires schema/source 7, including explicit null."
+                            .into(),
+                    );
+                }
+                pending.extend(fields.values().rev());
             }
-            if fields.get("Relation").and_then(serde_json::Value::as_str) == Some("ContextualLink")
-            {
-                return Err("ContextualLink view selectors require schema/source 7.".into());
-            }
-            if fields.keys().any(|key| {
-                matches!(
-                    key.as_str(),
-                    "Operation"
-                        | "ContextOwner"
-                        | "ContextSource"
-                        | "ContextTarget"
-                        | "ContextPurpose"
-                )
-            }) {
-                return Err(
-                    "Operation/contextual-link semantic facets require schema/source 7.".into(),
-                );
-            }
-            if fields
-                .get("Exchange")
-                .and_then(serde_json::Value::as_object)
-                .is_some_and(|body| body.contains_key("operation"))
-            {
-                return Err(
-                    "Exchange.operation requires schema/source 7, including explicit null.".into(),
-                );
-            }
-            for nested in fields.values() {
-                reject_source7_fields(nested)?;
+            serde_json::Value::Array(values) => {
+                pending.extend(values.iter().rev());
             }
+            _ => {}
         }
-        serde_json::Value::Array(values) => {
-            for nested in values {
-                reject_source7_fields(nested)?;
-            }
-        }
-        _ => {}
     }
     Ok(())
 }
@@ -420,6 +451,7 @@ pub(crate) fn migrate_v6(
     if project.schema_version != 6 {
         return Err(FileError::Invalid("Expected schema_version 6.".into()));
     }
+    reject_pre8_project(&project)?;
     reject_source7_fields(&serde_json::to_value(&project)?).map_err(FileError::Invalid)?;
     limits.check_model(&project).map_err(FileError::Limit)?;
     project.schema_version = SCHEMA_VERSION;
@@ -429,6 +461,30 @@ pub(crate) fn migrate_v6(
     })
 }
 
+pub(crate) fn migrate_v7(
+    mut project: Project,
+    limits: crate::language::ParseLimits,
+) -> Result<DecodeResult, FileError> {
+    if project.schema_version != 7 {
+        return Err(FileError::Invalid("Expected schema_version 7.".into()));
+    }
+    reject_pre8_project(&project)?;
+    limits.check_model(&project).map_err(FileError::Limit)?;
+    project.schema_version = SCHEMA_VERSION;
+    Ok(DecodeResult {
+        project,
+        migration: Some(MigrationReport::data_upgrade(7)),
+    })
+}
+fn reject_pre8_project(project: &Project) -> Result<(), FileError> {
+    if !project.definitions.is_empty() {
+        return Err(FileError::Invalid(
+            "Definitions require schema/source 8.".into(),
+        ));
+    }
+    v7::reject_elements(project.elements.values())
+}
+
 pub(crate) fn migrate_v1_with_report_limited(
     old: v1::Project,
     limits: crate::language::ParseLimits,
@@ -846,6 +902,9 @@ pub(crate) mod v1 {
 }
 
 fn validate_project(p: &Project) -> Result<(), FileError> {
+    json_codec::document_stack(|| validate_project_inner(p))
+}
+fn validate_project_inner(p: &Project) -> Result<(), FileError> {
     if let Some(i) = validation::validate(p)
         .into_iter()
         .find(|i| i.severity == validation::Severity::Error)
@@ -861,7 +920,10 @@ pub fn load(path: &Path) -> Result<Project, FileError> {
     load_with_report(path).map(|decoded| decoded.project)
 }
 pub fn load_with_report(path: &Path) -> Result<DecodeResult, FileError> {
-    decode_with_report(&std::fs::read(path)?)
+    decode_with_report(&json_codec::read_bounded(
+        path,
+        json_codec::MAX_DOCUMENT_BYTES,
+    )?)
 }
 /// Serialize to a sibling temporary file, flush, then atomically replace the destination.
 pub fn save(path: &Path, p: &Project) -> Result<(), FileError> {
@@ -874,19 +936,69 @@ pub fn save_checked(
     path: &Path,
     p: &Project,
     expected: Option<&[u8]>,
+) -> Result<Vec<u8>, FileError> {
+    save_checked_profile(
+        path,
+        p,
+        expected,
+        json_codec::Profile::DOCUMENT,
+        json_codec::DEPTH_128_VALIDATED,
+    )
+}
+fn save_checked_profile(
+    path: &Path,
+    p: &Project,
+    expected: Option<&[u8]>,
+    profile: json_codec::Profile,
+    depth_128: bool,
+) -> Result<Vec<u8>, FileError> {
+    save_checked_profile_with_source(path, p, expected, profile, depth_128, |project| {
+        crate::language::format(project).into_bytes()
+    })
+}
+// Keep the source writer replaceable only at this private seam so regressions
+// can prove that malformed or lossy output never reaches filesystem staging.
+fn save_checked_profile_with_source(
+    path: &Path,
+    p: &Project,
+    expected: Option<&[u8]>,
+    profile: json_codec::Profile,
+    depth_128: bool,
+    source: impl FnOnce(&Project) -> Vec<u8>,
 ) -> Result<Vec<u8>, FileError> {
     validate_project(p)?;
-    let mut bytes = if path
+    let is_source = path
         .extension()
-        .is_some_and(|ext| ext.eq_ignore_ascii_case("arcadia"))
-    {
-        crate::language::format(p).into_bytes()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("arcadia"));
+    let mut bytes = if is_source {
+        source(p)
     } else {
-        serde_json::to_vec_pretty(p)?
+        json_codec::encode(p, profile, depth_128)?
     };
     if !bytes.ends_with(b"\n") {
         bytes.push(b'\n');
     }
+    if is_source {
+        // Check exactly the final bytes, including their newline, through the
+        // public reader before creating a temp file or replacing a destination.
+        let decoded = decode_with_report_limited(
+            &bytes,
+            crate::language::ParseLimits {
+                max_source_bytes: profile.bytes,
+                ..crate::language::ParseLimits::UNLIMITED
+            },
+        )?;
+        if decoded.project != *p {
+            return Err(FileError::Invalid(
+                "Generated source does not reproduce the complete requested project.".into(),
+            ));
+        }
+        if decoded.migration.is_some() {
+            return Err(FileError::Invalid(
+                "Generated source unexpectedly requires migration.".into(),
+            ));
+        }
+    }
     let parent = path
         .parent()
         .filter(|p| !p.as_os_str().is_empty())
@@ -895,8 +1007,8 @@ pub fn save_checked(
     temp.write_all(&bytes)?;
     temp.as_file().sync_all()?;
     if let Some(expected) = expected {
-        match std::fs::read(path) {
-            Ok(current) if current == expected => {}
+        match json_codec::matches_file(path, expected) {
+            Ok(true) => {}
             Ok(_) => return Err(FileError::Conflict),
             Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Err(FileError::Conflict),
             Err(e) => return Err(FileError::Io(e)),

crates/oa-core/src/persistence/json_codec.rs

@@ -0,0 +1,427 @@
+//! Private persistence JSON boundary. Scan original bytes before Serde allocates;
+//! the scanner is a resource meter, never a second accepting JSON grammar.
+use super::FileError;
+use crate::{
+    Project,
+    analysis::expression_serde::{self, Scope},
+};
+use serde::{
+    Deserialize,
+    de::{IgnoredAny, MapAccess, Visitor},
+};
+use std::{
+    fmt,
+    io::{self, Read, Write},
+};
+
+pub(super) const MAX_DOCUMENT_BYTES: usize = 64 * 1024 * 1024;
+const MAX_CONTAINERS: usize = 512;
+// This switch stays false until Windows/Linux debug/release codec + ordinary
+// lifecycle gates pass. Tests exercise the candidate through the same private
+// entry point with depth_128=true. It is not a user-controlled parser option.
+pub(super) const DEPTH_128_VALIDATED: bool = false;
+
+/// Allocation cardinalities, independent of graph admission and numeric work.
+/// The default deliberately admits the existing CLI's 100000 graph objects,
+/// 250000 records and 500000 ordered references within its 64 MiB envelope.
+/// Strings have no new 1 MiB restriction: any span fitting that envelope fits.
+/// These are explicit slot/text bounds, not an assertion of process RSS.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct Profile {
+    pub bytes: usize,
+    pub tokens: usize,
+    pub entries: usize,
+    pub container_entries: usize,
+    pub string_bytes: usize,
+    pub total_string_bytes: usize,
+    pub expression_nodes: usize,
+}
+impl Profile {
+    pub const DOCUMENT: Self = Self {
+        bytes: MAX_DOCUMENT_BYTES,
+        tokens: 16 * 1024 * 1024,
+        entries: 8 * 1024 * 1024,
+        container_entries: 500_000,
+        string_bytes: MAX_DOCUMENT_BYTES,
+        total_string_bytes: MAX_DOCUMENT_BYTES,
+        expression_nodes: expression_serde::MAX_JSON_EXPRESSION_NODES,
+    };
+    pub fn with_byte_limit(maximum: usize) -> Self {
+        Self {
+            bytes: maximum.min(MAX_DOCUMENT_BYTES),
+            ..Self::DOCUMENT
+        }
+    }
+}
+
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub(super) struct Usage {
+    pub tokens: usize,
+    pub entries: usize,
+    pub string_bytes: usize,
+    pub deepest_container: usize,
+}
+#[derive(Clone, Copy)]
+struct Container {
+    delimiter: u8,
+    entries: usize,
+    first: bool,
+}
+const EMPTY: Container = Container {
+    delimiter: 0,
+    entries: 0,
+    first: true,
+};
+
+fn limit(message: &str) -> FileError {
+    FileError::Limit(message.into())
+}
+fn charge(used: &mut usize, amount: usize, maximum: usize, message: &str) -> Result<(), FileError> {
+    if amount > maximum.saturating_sub(*used) {
+        return Err(limit(message));
+    }
+    *used += amount;
+    Ok(())
+}
+
+pub(super) fn preflight(bytes: &[u8], profile: Profile) -> Result<Usage, FileError> {
+    if bytes.len() > profile.bytes {
+        return Err(limit("JSON input byte limit exceeded."));
+    }
+    // Fixed storage: no Vec/Value/String and no recursive calls during preflight.
+    let mut containers = [EMPTY; MAX_CONTAINERS];
+    let mut depth = 0usize;
+    let mut usage = Usage::default();
+    let mut cursor = 0usize;
+    while cursor < bytes.len() {
+        let byte = bytes[cursor];
+        if byte.is_ascii_whitespace() {
+            cursor += 1;
+            continue;
+        }
+        charge(
+            &mut usage.tokens,
+            1,
+            profile.tokens,
+            "JSON token limit exceeded.",
+        )?;
+        if !matches!(byte, b',' | b':' | b'}' | b']') && depth > 0 {
+            let frame = &mut containers[depth - 1];
+            if frame.first {
+                charge(
+                    &mut frame.entries,
+                    1,
+                    profile.container_entries,
+                    "JSON container entry limit exceeded.",
+                )?;
+                charge(
+                    &mut usage.entries,
+                    1,
+                    profile.entries,
+                    "JSON aggregate entry limit exceeded.",
+                )?;
+                frame.first = false;
+            }
+        }
+        match byte {
+            b'{' | b'[' => {
+                if depth == MAX_CONTAINERS {
+                    return Err(limit("JSON container depth exceeds 512."));
+                }
+                containers[depth] = Container {
+                    delimiter: byte,
+                    ..EMPTY
+                };
+                depth += 1;
+                usage.deepest_container = usage.deepest_container.max(depth);
+                cursor += 1;
+            }
+            b'}' | b']' => {
+                if depth == 0
+                    || !matches!(
+                        (containers[depth - 1].delimiter, byte),
+                        (b'{', b'}') | (b'[', b']')
+                    )
+                {
+                    return Err(FileError::Invalid(
+                        "Mismatched JSON container delimiter.".into(),
+                    ));
+                }
+                depth -= 1;
+                cursor += 1;
+            }
+            b',' => {
+                if depth > 0 {
+                    containers[depth - 1].first = true;
+                }
+                cursor += 1;
+            }
+            b':' => cursor += 1,
+            b'"' => {
+                cursor += 1;
+                let start = cursor;
+                let mut closed = false;
+                while cursor < bytes.len() {
+                    match bytes[cursor] {
+                        b'"' => {
+                            closed = true;
+                            break;
+                        }
+                        b'\\' => {
+                            // Skip exactly one escaped byte, including an escaped
+                            // backslash. Serde validates actual escapes/UTF-8.
+                            cursor += 1;
+                            if cursor < bytes.len() {
+                                cursor += 1;
+                            }
+                        }
+                        _ => cursor += 1,
+                    }
+                }
+                let span = cursor - start;
+                if span > profile.string_bytes {
+                    return Err(limit("JSON string byte limit exceeded."));
+                }
+                charge(
+                    &mut usage.string_bytes,
+                    span,
+                    profile.total_string_bytes,
+                    "JSON aggregate string byte limit exceeded.",
+                )?;
+                if !closed {
+                    return Err(FileError::Invalid("Unterminated JSON string.".into()));
+                }
+                cursor += 1;
+            }
+            _ => {
+                // Count a scalar token without interpreting its value. Invalid
+                // tokens and invalid whitespace must still fail the Serde pass.
+                cursor += 1;
+                while cursor < bytes.len()
+                    && !bytes[cursor].is_ascii_whitespace()
+                    && !matches!(
+                        bytes[cursor],
+                        b'{' | b'[' | b'}' | b']' | b',' | b':' | b'"'
+                    )
+                {
+                    cursor += 1;
+                }
+            }
+        }
+    }
+    if depth != 0 {
+        return Err(FileError::Invalid("Unclosed JSON container.".into()));
+    }
+    Ok(usage)
+}
+
+struct Version(Option<u64>);
+impl<'de> Deserialize<'de> for Version {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        struct Header;
+        impl<'de> Visitor<'de> for Header {
+            type Value = Version;
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a project header")
+            }
+            fn visit_map<A: MapAccess<'de>>(self, mut access: A) -> Result<Version, A::Error> {
+                #[derive(Deserialize)]
+                #[serde(field_identifier)]
+                enum Key {
+                    #[serde(rename = "schema_version")]
+                    Schema,
+                    #[serde(other)]
+                    Other,
+                }
+                let mut version = None;
+                while let Some(key) = access.next_key::<Key>()? {
+                    match key {
+                        Key::Schema => {
+                            if version.is_some() {
+                                return Err(serde::de::Error::duplicate_field("schema_version"));
+                            }
+                            version = Some(access.next_value()?);
+                        }
+                        Key::Other => {
+                            access.next_value::<IgnoredAny>()?;
+                        }
+                    }
+                }
+                Ok(Version(version))
+            }
+        }
+        deserializer.deserialize_map(Header)
+    }
+}
+
+/// IgnoredAny in serde_json walks arbitrary ignored containers iteratively.
+/// This probe does not materialize ignored subtrees. Serde's scratch buffer for
+/// container markers/escaped keys is bounded by the preceding raw scan. It
+/// consumes the entire original stream and rejects duplicate/escaped versions.
+pub(super) fn version(bytes: &[u8]) -> Result<Option<u64>, FileError> {
+    document_stack(|| {
+        let mut deserializer = serde_json::Deserializer::from_slice(bytes);
+        let version = Version::deserialize(&mut deserializer)?;
+        deserializer.end()?;
+        Ok(version.0)
+    })
+}
+
+pub(super) fn document_stack<R>(operation: impl FnOnce() -> R) -> R {
+    // Non-Expr Project and historical schemas are finitely nested by their
+    // concrete Rust types. Reserve for that outer generated Serde frame chain;
+    // only recursive Expr edges use the smaller repeated boundary guard.
+    stacker::maybe_grow(512 * 1024, 2 * 1024 * 1024, operation)
+}
+pub(super) fn current(
+    bytes: &[u8],
+    profile: Profile,
+    depth_128: bool,
+) -> Result<Project, FileError> {
+    preflight(bytes, profile)?;
+    let _scope = Scope::decoding(profile.expression_nodes);
+    document_stack(|| {
+        let mut deserializer = serde_json::Deserializer::from_slice(bytes);
+        if depth_128 {
+            deserializer.disable_recursion_limit();
+        }
+        let project = Project::deserialize(&mut deserializer)?;
+        deserializer.end()?;
+        Ok(project)
+    })
+}
+pub(super) fn legacy<T: serde::de::DeserializeOwned>(bytes: &[u8]) -> Result<T, FileError> {
+    // Never disable the legacy recursion guard, including its temporary Value.
+    document_stack(|| Ok(serde_json::from_slice(bytes)?))
+}
+
+pub(super) fn discard_value(value: serde_json::Value) {
+    let mut pending = vec![value];
+    while let Some(value) = pending.pop() {
+        match value {
+            serde_json::Value::Array(values) => pending.extend(values),
+            serde_json::Value::Object(values) => pending.extend(values.into_values()),
+            _ => {}
+        }
+    }
+}
+
+fn reserve_bounded(bytes: &mut Vec<u8>, additional: usize, maximum: usize) -> io::Result<()> {
+    let required = bytes.len() + additional;
+    if required > bytes.capacity() {
+        let next = bytes
+            .capacity()
+            .max(4096)
+            .saturating_mul(2)
+            .max(required)
+            .min(maximum);
+        bytes
+            .try_reserve_exact(next - bytes.len())
+            .map_err(io::Error::other)?;
+    }
+    Ok(())
+}
+
+struct CappedWriter {
+    bytes: Vec<u8>,
+    maximum: usize,
+    exceeded: bool,
+}
+impl CappedWriter {
+    fn new(maximum: usize) -> Self {
+        Self {
+            bytes: Vec::new(),
+            maximum,
+            exceeded: false,
+        }
+    }
+}
+impl Write for CappedWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        if bytes.len() > self.maximum.saturating_sub(self.bytes.len()) {
+            self.exceeded = true;
+            return Err(io::Error::other("JSON output byte limit exceeded."));
+        }
+        // Check before reserve/extend; failed output never creates a giant Vec.
+        reserve_bounded(&mut self.bytes, bytes.len(), self.maximum)?;
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+/// Compact output avoids indentation multiplying the cost of legal depth128.
+/// The returned bytes have already passed the identical reader resource profile.
+pub(super) fn encode(
+    project: &Project,
+    profile: Profile,
+    depth_128: bool,
+) -> Result<Vec<u8>, FileError> {
+    let _scope = Scope::encoding(profile.expression_nodes);
+    let mut writer = CappedWriter::new(profile.bytes);
+    let result = document_stack(|| serde_json::to_writer(&mut writer, project));
+    if writer.exceeded {
+        return Err(limit("JSON output byte limit exceeded."));
+    }
+    result?;
+    writer.write_all(b"\n").map_err(|error| {
+        if writer.exceeded {
+            limit("JSON output byte limit exceeded.")
+        } else {
+            FileError::Io(error)
+        }
+    })?;
+    // Establish save/reopen symmetry before filesystem mutation, including the
+    // conservative production guard until the deeper profile is validated.
+    let reopened = current(&writer.bytes, profile, depth_128)?;
+    if reopened != *project {
+        return Err(FileError::Invalid(
+            "JSON serialization did not preserve the project value.".into(),
+        ));
+    }
+    Ok(writer.bytes)
+}
+
+pub(super) fn read_bounded(path: &std::path::Path, maximum: usize) -> Result<Vec<u8>, FileError> {
+    let mut file = std::fs::File::open(path)?;
+    if file.metadata()?.len() > maximum as u64 {
+        return Err(limit("Input file byte limit exceeded."));
+    }
+    let mut bytes = Vec::new();
+    let mut chunk = [0u8; 8192];
+    loop {
+        let count = file.read(&mut chunk)?;
+        if count == 0 {
+            return Ok(bytes);
+        }
+        if count > maximum.saturating_sub(bytes.len()) {
+            return Err(limit("Input file byte limit exceeded."));
+        }
+        reserve_bounded(&mut bytes, count, maximum)?;
+        bytes.extend_from_slice(&chunk[..count]);
+    }
+}
+
+pub(super) fn matches_file(path: &std::path::Path, expected: &[u8]) -> io::Result<bool> {
+    let mut file = std::fs::File::open(path)?;
+    if file.metadata()?.len() != expected.len() as u64 {
+        return Ok(false);
+    }
+    let mut compared = 0usize;
+    let mut chunk = [0u8; 8192];
+    loop {
+        let count = file.read(&mut chunk)?;
+        if count == 0 {
+            return Ok(compared == expected.len());
+        }
+        if expected.get(compared..compared + count) != Some(&chunk[..count]) {
+            return Ok(false);
+        }
+        compared += count;
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/persistence/json_codec/tests.rs

@@ -0,0 +1,612 @@
+use super::*;
+use crate::{
+    Element, ElementBody, Id, OaBody,
+    analysis::{
+        AnalysisType, Binding, CalculationDefinition, Definition, DefinitionBody, Expr, Parameter,
+        ParameterId, ScalarType, UnaryOp,
+    },
+    language::ParseLimits,
+    persistence,
+};
+use std::{
+    fmt::Write as _,
+    process::{Command, Stdio},
+    time::{Duration, Instant},
+};
+
+const IDENTITY: &str = "00000000-0000-0000-0000-000000000001";
+const PARAMETER: &str = "00000000-0000-0000-0000-000000000002";
+const MAIN: &str = "00000000-0000-0000-0000-000000000003";
+fn id(value: &str) -> Id {
+    Id::parse_str(value).unwrap()
+}
+fn boolean_type() -> AnalysisType {
+    AnalysisType::Scalar(ScalarType::Boolean)
+}
+fn definition(id: Id, alias: &str, parameters: Vec<Parameter>, body: Expr) -> Definition {
+    Definition {
+        id,
+        alias: alias.into(),
+        name: alias.into(),
+        description: String::new(),
+        body: DefinitionBody::Calculation(CalculationDefinition {
+            parameters,
+            result: boolean_type(),
+            body: Binding::Expression(body),
+        }),
+    }
+}
+fn project() -> Project {
+    let mut project = Project::empty();
+    project.id = Id::from_u128(1000);
+    project.definitions.insert(
+        id(IDENTITY),
+        definition(
+            id(IDENTITY),
+            "identity",
+            vec![Parameter {
+                id: ParameterId(id(PARAMETER)),
+                name: "value".into(),
+                value_type: boolean_type(),
+            }],
+            Expr::Parameter(ParameterId(id(PARAMETER))),
+        ),
+    );
+    project.definitions.insert(
+        id(MAIN),
+        definition(id(MAIN), "main", vec![], Expr::Boolean(true)),
+    );
+    project
+}
+fn wire(expression: &str) -> Vec<u8> {
+    let shallow = serde_json::to_string(&project()).unwrap();
+    assert_eq!(shallow.matches(r#"{"Boolean":true}"#).count(), 1);
+    shallow
+        .replace(r#"{"Boolean":true}"#, expression)
+        .into_bytes()
+}
+fn chain(depth: usize, call: bool) -> String {
+    assert!(depth > 0);
+    let prefix = if call {
+        format!(r#"{{"Call":{{"definition":{{"Local":"{IDENTITY}"}},"arguments":{{"{PARAMETER}":"#)
+    } else {
+        r#"{"Unary":{"op":"Not","operand":"#.into()
+    };
+    let suffix = if call { "}}}" } else { "}}" };
+    format!(
+        "{}{}{}",
+        prefix.repeat(depth - 1),
+        r#"{"Boolean":true}"#,
+        suffix.repeat(depth - 1)
+    )
+}
+fn candidate(bytes: &[u8], profile: Profile) -> Result<Project, FileError> {
+    persistence::decode_with_report_profile(bytes, ParseLimits::UNLIMITED, profile, true)
+        .map(|decoded| decoded.project)
+}
+
+#[test]
+fn resource_preflight_has_exact_lowerable_boundaries() {
+    let bytes = br#"{"key":["a\\\"[{}]",0,true],"other":"\u0061"}"#;
+    let usage = preflight(bytes, Profile::DOCUMENT).unwrap();
+    let exact = Profile {
+        bytes: bytes.len(),
+        tokens: usage.tokens,
+        entries: usage.entries,
+        container_entries: 3,
+        string_bytes: 9,
+        total_string_bytes: usage.string_bytes,
+        ..Profile::DOCUMENT
+    };
+    preflight(bytes, exact).unwrap();
+    for lower in [
+        Profile {
+            bytes: exact.bytes - 1,
+            ..exact
+        },
+        Profile {
+            tokens: exact.tokens - 1,
+            ..exact
+        },
+        Profile {
+            entries: exact.entries - 1,
+            ..exact
+        },
+        Profile {
+            container_entries: 2,
+            ..exact
+        },
+        Profile {
+            total_string_bytes: exact.total_string_bytes - 1,
+            ..exact
+        },
+        Profile {
+            string_bytes: exact.string_bytes - 1,
+            ..exact
+        },
+    ] {
+        assert!(matches!(preflight(bytes, lower), Err(FileError::Limit(_))));
+    }
+    let deepest = format!("{}0{}", "[".repeat(512), "]".repeat(512));
+    assert_eq!(
+        preflight(deepest.as_bytes(), Profile::DOCUMENT)
+            .unwrap()
+            .deepest_container,
+        512
+    );
+    assert!(matches!(
+        preflight(format!("[{deepest}]").as_bytes(), Profile::DOCUMENT),
+        Err(FileError::Limit(_))
+    ));
+    // A huge ignored scalar array exhausts preflight before a header is decoded.
+    assert!(matches!(
+        preflight(
+            br#"{"schema_version":8,"junk":[0,0,0,0]}"#,
+            Profile {
+                container_entries: 3,
+                ..Profile::DOCUMENT
+            }
+        ),
+        Err(FileError::Limit(_))
+    ));
+}
+
+#[test]
+fn scanner_is_not_a_parallel_json_grammar() {
+    for bytes in [
+        br#"{"schema_version":8}{}"#.as_slice(),
+        br#"{"schema_version":8,}"#,
+        br#"{"schema_version":8 "junk":0}"#,
+        br#"{"schema_version":8,"schema_version":8}"#,
+        br#"{"schema_version":8,"\u0073chema_version":8}"#,
+        br#"{"schema_version":8,"junk":"\q"}"#,
+        br#"{"schema_version":8,"junk":"unfinished}"#,
+        br#"{"schema_version":8,"junk":[}"#,
+    ] {
+        assert!(candidate(bytes, Profile::DOCUMENT).is_err(), "{bytes:?}");
+    }
+    let mut invalid_utf8 = wire(r#"{"Boolean":true}"#);
+    let offset = invalid_utf8
+        .windows(7)
+        .position(|window| window == b"mission")
+        .unwrap();
+    invalid_utf8[offset] = 0xff;
+    assert!(candidate(&invalid_utf8, Profile::DOCUMENT).is_err());
+    let escaped = String::from_utf8(wire(r#"{"Boolean":true}"#))
+        .unwrap()
+        .replace(r#""schema_version""#, r#""\u0073chema_version""#);
+    assert_eq!(
+        candidate(escaped.as_bytes(), Profile::DOCUMENT).unwrap(),
+        project()
+    );
+}
+
+#[test]
+fn remote_serde_keeps_each_existing_expression_variant() {
+    let n = r#"{"Number":{"numerator":"1","denominator":"1"}}"#;
+    let b = r#"{"Boolean":true}"#;
+    let expressions = [
+        b.to_string(),
+        n.to_string(),
+        format!(
+            r#"{{"Quantity":{{"magnitude":{{"numerator":"1","denominator":"1"}},"unit":{{"Local":"{IDENTITY}"}}}}}}"#
+        ),
+        format!(r#"{{"Property":"{IDENTITY}"}}"#),
+        format!(r#"{{"Parameter":"{PARAMETER}"}}"#),
+        format!(r#"{{"List":[{n},{n}]}}"#),
+        format!(r#"{{"Unary":{{"op":"Not","operand":{b}}}}}"#),
+        format!(r#"{{"Binary":{{"op":"Add","left":{n},"right":{n}}}}}"#),
+        format!(r#"{{"If":{{"condition":{b},"when_true":{n},"when_false":{n}}}}}"#),
+        format!(
+            r#"{{"Call":{{"definition":{{"Local":"{IDENTITY}"}},"arguments":{{"{PARAMETER}":{b}}}}}}}"#
+        ),
+        format!(r#"{{"Sum":{{"values":{{"List":[{n}]}},"initial":{n}}}}}"#),
+        format!(r#"{{"Power":{{"base":{n},"exponent":2}}}}"#),
+        format!(r#"{{"AsKind":{{"kind":{{"Local":"{IDENTITY}"}},"value":{n}}}}}"#),
+    ];
+    for original in expressions {
+        let value: Expr = serde_json::from_str(&original).unwrap();
+        let copy = value.clone();
+        assert!(value == copy);
+        assert_eq!(serde_json::to_string(&value).unwrap(), original);
+        assert_eq!(format!("{value:?}"), format!("{copy:?}"));
+    }
+    let list = Expr::List(vec![Expr::Boolean(true), Expr::Boolean(false)]);
+    assert_eq!(format!("{list:?}"), "List([Boolean(true), Boolean(false)])");
+    assert!(list != Expr::List(vec![Expr::Boolean(false), Expr::Boolean(true)]));
+}
+
+#[test]
+fn json_profile_does_not_contract_declared_cli_collection_counts() {
+    // Exercise original-byte typed construction at the existing graph ceiling.
+    // This gate checks codec/count compatibility, not 100000-object UI speed.
+    let mut model = Project::empty();
+    model.id = Id::from_u128(1_000_000);
+    for value in 1..=100_000 {
+        let id = Id::from_u128(value);
+        model.elements.insert(
+            id,
+            Element {
+                id,
+                alias: format!("activity_{value}"),
+                name: String::new(),
+                description: String::new(),
+                parent: None,
+                body: ElementBody::Oa(OaBody::Activity),
+            },
+        );
+    }
+    let bytes = encode(&model, Profile::DOCUMENT, true).unwrap();
+    let decoded = current(&bytes, Profile::DOCUMENT, true).unwrap();
+    assert_eq!(decoded.elements.len(), 100_000);
+    let cli = ParseLimits {
+        max_source_bytes: 64 * 1024 * 1024,
+        max_graph_objects: 100_000,
+        max_records: 250_000,
+        max_step_references: 500_000,
+    };
+    cli.check_model(&decoded).unwrap();
+    let references = format!(
+        "[{}\"{IDENTITY}\"]",
+        format!("\"{IDENTITY}\",").repeat(499_999)
+    );
+    preflight(references.as_bytes(), Profile::DOCUMENT).unwrap();
+    assert!(matches!(
+        preflight(
+            format!("[\"{IDENTITY}\",{}]", &references[1..references.len() - 1]).as_bytes(),
+            Profile::DOCUMENT
+        ),
+        Err(FileError::Limit(_))
+    ));
+    // Metadata over the initially proposed 1 MiB limit remains admissible.
+    let mut text = Project::empty();
+    text.description = "x".repeat(1024 * 1024 + 1);
+    let bytes = encode(&text, Profile::DOCUMENT, true).unwrap();
+    assert_eq!(current(&bytes, Profile::DOCUMENT, true).unwrap(), text);
+    eprintln!(
+        "JSON profile: graph bytes={}, ordered-reference bytes={}, max container entries={}",
+        serde_json::to_string(&model).unwrap().len(),
+        references.len(),
+        Profile::DOCUMENT.container_entries
+    );
+}
+
+#[test]
+fn production_save_always_reopens_with_its_reader_profile() {
+    let deep = candidate(&wire(&chain(128, true)), Profile::DOCUMENT).unwrap();
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("project.json");
+    std::fs::write(&path, b"previous").unwrap();
+    let saved = persistence::save_checked(&path, &deep, Some(b"previous"));
+    if DEPTH_128_VALIDATED {
+        let bytes = saved.unwrap();
+        assert_eq!(persistence::decode(&bytes).unwrap(), deep);
+    } else {
+        assert!(saved.is_err());
+        assert_eq!(std::fs::read(&path).unwrap(), b"previous");
+    }
+}
+
+fn accepted_phase() {
+    for call in [false, true] {
+        let bytes = wire(&chain(128, call));
+        let usage = preflight(&bytes, Profile::DOCUMENT).unwrap();
+        let model = candidate(&bytes, Profile::DOCUMENT).unwrap();
+        let copy = model.clone();
+        assert!(model == copy);
+        let debug = format!("{model:?}");
+        assert!(!debug.is_empty());
+        let output = encode(&model, Profile::DOCUMENT, true).unwrap();
+        assert!(candidate(&output, Profile::DOCUMENT).unwrap() == model);
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("deep.json");
+        let saved = persistence::save_checked_profile(&path, &model, None, Profile::DOCUMENT, true)
+            .unwrap();
+        assert!(
+            candidate(
+                &read_bounded(&path, MAX_DOCUMENT_BYTES).unwrap(),
+                Profile::DOCUMENT
+            )
+            .unwrap()
+                == model
+        );
+        assert_eq!(saved, output);
+        eprintln!(
+            "accepted call={call} depth128 input={} output={} tokens={} entries={} raw strings={} containers={} debug={}",
+            bytes.len(),
+            output.len(),
+            usage.tokens,
+            usage.entries,
+            usage.string_bytes,
+            usage.deepest_container,
+            debug.len()
+        );
+    }
+}
+fn refused_phase() {
+    for call in [false, true] {
+        let error = candidate(&wire(&chain(129, call)), Profile::DOCUMENT).unwrap_err();
+        assert!(error.to_string().contains("logical depth"), "{error}");
+    }
+    let wide = format!(
+        r#"{{"List":[{}null]}}"#,
+        r#"{"Boolean":true},"#.repeat(1024)
+    );
+    let error = candidate(&wire(&wide), Profile::DOCUMENT).unwrap_err();
+    assert!(error.to_string().contains("1024"), "{error}");
+    let bytes = wire(&chain(128, true));
+    let exact_model = candidate(
+        &bytes,
+        Profile {
+            expression_nodes: 129,
+            ..Profile::DOCUMENT
+        },
+    )
+    .unwrap();
+    let error = candidate(
+        &bytes,
+        Profile {
+            expression_nodes: 128,
+            ..Profile::DOCUMENT
+        },
+    )
+    .unwrap_err();
+    // Identity's Parameter plus main's 128-node expression exceed this total.
+    assert!(error.to_string().contains("allocation count"), "{error}");
+    let scan = preflight(&bytes, Profile::DOCUMENT).unwrap();
+    assert!(matches!(
+        candidate(
+            &bytes,
+            Profile {
+                tokens: scan.tokens - 1,
+                ..Profile::DOCUMENT
+            }
+        ),
+        Err(FileError::Limit(_))
+    ));
+    document_stack(|| {
+        use crate::analysis::{AdmissionLimits, admit};
+        let events = admit(&exact_model, AdmissionLimits::REFERENCE)
+            .unwrap()
+            .admission_usage()
+            .static_events;
+        admit(
+            &exact_model,
+            AdmissionLimits {
+                max_static_events: events,
+            },
+        )
+        .unwrap();
+        let error = match admit(
+            &exact_model,
+            AdmissionLimits {
+                max_static_events: events - 1,
+            },
+        ) {
+            Ok(_) => panic!("Static work below the measured exact count must refuse."),
+            Err(error) => error,
+        };
+        assert_eq!(error.code, "analysis_limit");
+    });
+    let mut tree = r#"{"Boolean":true}"#.to_owned();
+    for _ in 0..15 {
+        tree = format!(r#"{{"Binary":{{"op":"And","left":{tree},"right":{tree}}}}}"#);
+    }
+    // 65535 balanced nodes plus one unary node is the stored-tree boundary.
+    tree = format!(r#"{{"Unary":{{"op":"Not","operand":{tree}}}}}"#);
+    let at_tree_limit = wire(&tree);
+    current(&at_tree_limit, Profile::DOCUMENT, true).unwrap();
+    let beyond = wire(&format!(r#"{{"Unary":{{"op":"Not","operand":{tree}}}}}"#));
+    assert!(
+        current(&beyond, Profile::DOCUMENT, true)
+            .unwrap_err()
+            .to_string()
+            .contains("65536")
+    );
+    // No downstream work after refusal poisons the next ordinary operation.
+    candidate(&wire(&chain(128, true)), Profile::DOCUMENT).unwrap();
+}
+fn malformed_phase() {
+    let deep = chain(127, false);
+    for (label, expression) in [
+        (
+            "duplicate operand",
+            format!(r#"{{"Unary":{{"op":"Not","operand":{deep},"operand":null}}}}"#),
+        ),
+        (
+            "escaped duplicate",
+            format!(r#"{{"Unary":{{"op":"Not","operand":{deep},"\u006fperand":null}}}}"#),
+        ),
+        (
+            "unknown field",
+            format!(r#"{{"Unary":{{"op":"Not","operand":{deep},"surprise":null}}}}"#),
+        ),
+        (
+            "duplicate enum",
+            format!(r#"{{"Unary":{{"op":"Not","operand":{deep}}},"Boolean":true}}"#),
+        ),
+        (
+            "duplicate parameter",
+            format!(
+                r#"{{"Call":{{"definition":{{"Local":"{IDENTITY}"}},"arguments":{{"{PARAMETER}":{deep},"\u0030{}":null}}}}}}"#,
+                &PARAMETER[1..]
+            ),
+        ),
+    ] {
+        let error = candidate(&wire(&expression), Profile::DOCUMENT).unwrap_err();
+        assert!(
+            !error.to_string().contains("logical depth"),
+            "{label}: {error}"
+        );
+        eprintln!("{label}: {error}");
+    }
+    let complete = String::from_utf8(wire(&chain(128, true))).unwrap();
+    let duplicate_late = format!(
+        r#"{},"name":"late duplicate"}}"#,
+        &complete[..complete.len() - 1]
+    );
+    assert!(candidate(duplicate_late.as_bytes(), Profile::DOCUMENT).is_err());
+    assert!(candidate(format!("{complete} null").as_bytes(), Profile::DOCUMENT).is_err());
+    let invalid_surrogate = complete.replace(r#""description":"""#, r#""description":"\uD800""#);
+    assert!(candidate(invalid_surrogate.as_bytes(), Profile::DOCUMENT).is_err());
+    // Fully rejected raw depth also tears down without a recursive JSON Value.
+    let excessive = format!("{}0{}", "[".repeat(100_000), "]".repeat(100_000));
+    assert!(matches!(
+        preflight(excessive.as_bytes(), Profile::DOCUMENT),
+        Err(FileError::Limit(_))
+    ));
+}
+fn ownership_phase() {
+    let mut value = Expr::Boolean(true);
+    for _ in 1..100_000 {
+        value = Expr::Unary {
+            op: UnaryOp::Not,
+            operand: Box::new(value),
+        };
+    }
+    let mut copy = value.clone();
+    assert!(value == copy);
+    let mut cursor = &mut copy;
+    loop {
+        match cursor {
+            Expr::Unary { operand, .. } => cursor = operand,
+            Expr::Boolean(leaf) => {
+                *leaf = false;
+                break;
+            }
+            _ => unreachable!(),
+        }
+    }
+    assert!(value != copy);
+    // A streaming formatter avoids retaining a 100000-node Debug string.
+    struct Counter(usize);
+    impl fmt::Write for Counter {
+        fn write_str(&mut self, value: &str) -> fmt::Result {
+            self.0 += value.len();
+            Ok(())
+        }
+    }
+    let mut debug = Counter(0);
+    write!(&mut debug, "{value:?}").unwrap();
+    assert!(debug.0 > 100_000);
+    assert!(serde_json::to_writer(io::sink(), &value).is_err());
+    drop(value);
+    drop(copy);
+    eprintln!(
+        "iterative manual100000 ownership/debug/drop completed; debug bytes={}",
+        debug.0
+    );
+}
+fn atomic_phase() {
+    let model = project();
+    let bytes = encode(&model, Profile::DOCUMENT, true).unwrap();
+    let exact = Profile {
+        bytes: bytes.len(),
+        ..Profile::DOCUMENT
+    };
+    assert_eq!(encode(&model, exact, true).unwrap(), bytes);
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory.path().join("preserved.json");
+    std::fs::write(&path, b"original").unwrap();
+    let error = persistence::save_checked_profile(
+        &path,
+        &model,
+        Some(b"original"),
+        Profile {
+            bytes: bytes.len() - 1,
+            ..Profile::DOCUMENT
+        },
+        true,
+    )
+    .unwrap_err();
+    assert!(matches!(error, FileError::Limit(_)));
+    assert_eq!(std::fs::read(&path).unwrap(), b"original");
+    assert_eq!(std::fs::read_dir(directory.path()).unwrap().count(), 1);
+    let error = persistence::save_checked_profile(
+        &path,
+        &model,
+        Some(b"different"),
+        Profile::DOCUMENT,
+        true,
+    )
+    .unwrap_err();
+    assert!(matches!(error, FileError::Conflict));
+    assert_eq!(std::fs::read(&path).unwrap(), b"original");
+    assert_eq!(std::fs::read_dir(directory.path()).unwrap().count(), 1);
+    assert!(read_bounded(&path, 7).is_err());
+    assert_eq!(read_bounded(&path, 8).unwrap(), b"original");
+    let mut writer = CappedWriter::new(3);
+    writer.write_all(b"abc").unwrap();
+    let capacity = writer.bytes.capacity();
+    assert!(writer.write_all(b"d").is_err());
+    assert_eq!(writer.bytes, b"abc");
+    assert_eq!(writer.bytes.capacity(), capacity);
+}
+
+/// Root runs this exact test in each approved target/profile. Each phase runs in
+/// another process so a stack overflow is an explicit failed phase, and inside
+/// a 128 KiB thread (smaller than the ordinary test stack). No RUST_MIN_STACK
+/// override, ignored test, release-only path or increased test stack.
+#[test]
+fn codec_lifecycle_subprocess() {
+    const PHASE: &str = "ARCADIA_CODEC_LIFECYCLE_PHASE";
+    if let Ok(phase) = std::env::var(PHASE) {
+        eprintln!("codec child phase={phase}, configured thread stack=131072");
+        std::thread::Builder::new()
+            .name(format!("codec-{phase}"))
+            .stack_size(128 * 1024)
+            .spawn(move || match phase.as_str() {
+                "accepted" => accepted_phase(),
+                "refused" => refused_phase(),
+                "malformed" => malformed_phase(),
+                "ownership" => ownership_phase(),
+                "atomic" => atomic_phase(),
+                _ => panic!("Unknown codec phase"),
+            })
+            .unwrap()
+            .join()
+            .unwrap();
+        return;
+    }
+    for phase in ["accepted", "refused", "malformed", "ownership", "atomic"] {
+        let mut child = Command::new(std::env::current_exe().unwrap())
+            .args([
+                "--exact",
+                "persistence::json_codec::tests::codec_lifecycle_subprocess",
+                "--test-threads=1",
+                "--nocapture",
+            ])
+            .env(PHASE, phase)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        let start = Instant::now();
+        loop {
+            if child.try_wait().unwrap().is_some() {
+                break;
+            }
+            if start.elapsed() > Duration::from_secs(120) {
+                child.kill().unwrap();
+                let output = child.wait_with_output().unwrap();
+                panic!(
+                    "codec {phase} timed out: {}",
+                    String::from_utf8_lossy(&output.stderr)
+                );
+            }
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        let output = child.wait_with_output().unwrap();
+        eprintln!(
+            "codec {phase}: status={} elapsed={:?}\n{}{}",
+            output.status,
+            start.elapsed(),
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        );
+        assert!(
+            output.status.success(),
+            "codec phase {phase} aborted or failed"
+        );
+    }
+}

crates/oa-core/src/persistence/source_save_tests.rs

@@ -0,0 +1,145 @@
+//! Containment while the complete source8 adapter remains unavailable.
+use super::*;
+use crate::analysis::{Definition, DefinitionBody, QuantityAlgebra, QuantityKindDefinition};
+use crate::analysis_numeric::Dimension;
+use std::fs;
+
+const ORDINARY_SOURCE7: &str = concat!(
+    "arcadia 7;\n",
+    "project saved \"Saved model\" id \"4210b9f2-7046-47f0-aa3b-153f626a579d\" {\n",
+    "    description \"Retain café and exact identity\";\n",
+    "}",
+);
+
+fn ordinary() -> Project {
+    let decoded = decode_with_report(ORDINARY_SOURCE7.as_bytes()).unwrap();
+    assert!(decoded.migration.is_some());
+    decoded.project
+}
+
+fn directory_entries(path: &Path) -> Vec<std::ffi::OsString> {
+    let mut names = fs::read_dir(path)
+        .unwrap()
+        .map(|entry| entry.unwrap().file_name())
+        .collect::<Vec<_>>();
+    names.sort();
+    names
+}
+
+// A missing parent makes a mistakenly early NamedTempFile creation observable
+// as Io, even when the temp would otherwise be removed again on error.
+fn rejected_output(
+    project: &Project,
+    output: &[u8],
+    profile: json_codec::Profile,
+    check: impl Fn(&FileError),
+) {
+    let root = tempfile::tempdir().unwrap();
+    let existing = root.path().join("existing.arcadia");
+    let sentinel = b"external bytes must survive\r\n";
+    fs::write(&existing, sentinel).unwrap();
+    for path in [
+        existing.clone(),
+        root.path().join("new.arcadia"),
+        root.path().join("missing-parent/new.arcadia"),
+    ] {
+        let before = directory_entries(root.path());
+        let expected = (path == existing).then_some(sentinel.as_slice());
+        let error =
+            save_checked_profile_with_source(&path, project, expected, profile, false, |_| {
+                output.to_vec()
+            })
+            .unwrap_err();
+        check(&error);
+        assert_eq!(directory_entries(root.path()), before);
+        assert_eq!(fs::read(&existing).unwrap(), sentinel);
+        if path != existing {
+            assert!(!path.exists());
+        }
+    }
+}
+
+#[test]
+fn malformed_generated_source_rejects_before_any_filesystem_staging() {
+    rejected_output(
+        &ordinary(),
+        b"arcadia",
+        json_codec::Profile::DOCUMENT,
+        |error| assert!(matches!(error, FileError::Text(_)), "{error}"),
+    );
+}
+
+#[test]
+fn parseable_source_omitting_a_definition_cannot_replace_the_whole_project() {
+    let mut project = ordinary();
+    let id = Id::parse_str("188b911c-5f8b-431c-9eea-2d41f3953767").unwrap();
+    project.definitions.insert(
+        id,
+        Definition {
+            id,
+            alias: "duration".into(),
+            name: "Duration".into(),
+            description: "Unused definitions are still authored model data.".into(),
+            body: DefinitionBody::QuantityKind(QuantityKindDefinition {
+                dimension: Dimension::new([0, 0, 1, 0, 0, 0, 0]).unwrap(),
+                algebra: QuantityAlgebra::Linear,
+            }),
+        },
+    );
+    validate_project(&project).unwrap();
+    let decoded = decode(ORDINARY_SOURCE7.as_bytes()).unwrap();
+    assert_eq!(decoded.id, project.id);
+    assert_eq!(decoded.name, project.name);
+    assert_eq!(decoded.elements, project.elements);
+    assert!(decoded.definitions.is_empty());
+    assert_ne!(decoded, project);
+    rejected_output(
+        &project,
+        ORDINARY_SOURCE7.as_bytes(),
+        json_codec::Profile::DOCUMENT,
+        |error| {
+            assert!(
+                matches!(error, FileError::Invalid(message)
+                if message == "Generated source does not reproduce the complete requested project."),
+                "{error}"
+            );
+        },
+    );
+}
+
+#[test]
+fn equal_project_from_generated_legacy_source_still_rejects_migration() {
+    rejected_output(
+        &ordinary(),
+        ORDINARY_SOURCE7.as_bytes(),
+        json_codec::Profile::DOCUMENT,
+        |error| {
+            assert!(
+                matches!(error, FileError::Invalid(message)
+                if message == "Generated source unexpectedly requires migration."),
+                "{error}"
+            );
+        },
+    );
+}
+
+#[test]
+fn generated_source_admission_checks_final_newline_under_the_effective_byte_limit() {
+    let project = ordinary();
+    let profile = json_codec::Profile::with_byte_limit(ORDINARY_SOURCE7.len());
+    rejected_output(&project, ORDINARY_SOURCE7.as_bytes(), profile, |error| {
+        assert!(matches!(error, FileError::Limit(_)), "{error}");
+    });
+    let mut terminated = ORDINARY_SOURCE7.as_bytes().to_vec();
+    terminated.push(b'\n');
+    let profile = json_codec::Profile::with_byte_limit(terminated.len());
+    // Existing final newline is not added twice: decoding now reaches the
+    // independent migration refusal, rather than exceeding this exact limit.
+    rejected_output(&project, &terminated, profile, |error| {
+        assert!(
+            matches!(error, FileError::Invalid(message)
+            if message == "Generated source unexpectedly requires migration."),
+            "{error}"
+        );
+    });
+}

crates/oa-core/src/references.rs

@@ -1,8 +1,14 @@
 use crate::*;
 use std::collections::BTreeSet;
 
-/// Every live reference in a typed element, including structural ownership.
+/// Architectural/project references, including analysis subjects/properties.
+/// Layer-neutral definition references and scoped parameters have separate domains.
 pub fn element_references(e: &Element) -> Vec<Id> {
+    if e.kind().is_analysis() {
+        let mut references: Vec<_> = crate::analysis::references::element_model_references(e).into_iter().collect();
+        references.extend(e.parent);
+        return references;
+    }
     let mut copy = e.clone();
     let mut refs = Vec::new();
     visit_element_refs(&mut copy, |id| refs.push(*id));
@@ -14,6 +20,8 @@ pub fn relation_references(r: &Relation) -> Vec<Id> {
     visit_relation_refs(&mut copy, |id| refs.push(*id));
     refs
 }
+/// Architectural mutable slots only. Analysis map keys require the fallible
+/// whole-project remap; use analysis::references for its typed domains.
 pub fn visit_element_refs(e: &mut Element, mut visit: impl FnMut(&mut Id)) {
     if let Some(parent) = &mut e.parent {
         visit(parent);
@@ -203,7 +211,10 @@ pub fn visit_relation_refs(r: &mut Relation, mut visit: impl FnMut(&mut Id)) {
         _ => {}
     }
 }
-pub fn remap_references(p: &mut Project, old: Id, new: Id) {
+pub fn remap_references(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
+    crate::analysis::references::check_remap(p, old, new)
+        .map_err(|error| ModelError(error.to_string()))?;
+    crate::analysis::references::remap_project(p, old, new);
     for e in p.elements.values_mut() {
         visit_element_refs(e, |id| {
             if *id == old {
@@ -265,6 +276,7 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
             });
         }
     }
+    Ok(())
 }
 /// IDs removed by a cascade. Cross-layer traced counterparts are never included.
 pub fn deletion_impact(p: &Project, id: Id) -> BTreeSet<Id> {
@@ -405,6 +417,9 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
         .iter()
         .map(|id| (*id, p.named(*id).to_string()))
         .collect();
+    // Analysis dependencies remain live: deleting their target rejects the
+    // transaction unless that transaction also explicitly repairs/removes them.
+    p.definitions.retain(|id, _| !removed.contains(id));
     p.elements.retain(|id, _| !removed.contains(id));
     p.relations.retain(|id, _| !removed.contains(id));
     p.diagrams.retain(|id, _| !removed.contains(id));

crates/oa-core/src/semantic/catalog.rs

@@ -604,6 +604,9 @@ fn catalog_facets(
     include_linked: bool,
 ) -> Result<Vec<FacetDrift>, String> {
     let (oa, sa) = (trace.oa, trace.sa);
+    if [oa, sa].iter().any(|id| project.elements.get(id).is_some_and(|element| element.kind().is_analysis())) {
+        return Err("Semantic review of analysis records is not implemented; header-only review is refused.".into());
+    }
     let mut selectors: BTreeSet<_> = scalar_selectors()
         .into_iter()
         .filter(|s| {

crates/oa-core/src/session.rs

@@ -19,6 +19,21 @@ pub enum Command {
     },
     CreateElement(Element),
     EditElement(Id, Element),
+    CreateDefinition(crate::analysis::Definition),
+    EditDefinition(Id, crate::analysis::Definition),
+    SetAnalysisBase {
+        property: Id,
+        binding: crate::analysis::Binding,
+    },
+    SetAnalysisOverride {
+        case: Id,
+        property: Id,
+        binding: crate::analysis::Binding,
+    },
+    ClearAnalysisOverride {
+        case: Id,
+        property: Id,
+    },
     CreateRelation(Relation),
     EditRelation(Id, Relation),
     CreateDiagram(Diagram),
@@ -453,6 +468,47 @@ fn apply_command(
             }
             Some(value.id)
         }
+        Command::CreateDefinition(value) => {
+            vacant(p, value.id)?;
+            p.definitions.insert(value.id, value.clone());
+            Some(value.id)
+        }
+        Command::EditDefinition(old, value) => {
+            if !p.definitions.contains_key(old) { return Err(missing()); }
+            let mut definition = value.clone();
+            definition.id = *old;
+            p.definitions.insert(*old, definition);
+            reidentify_tracked(p, *old, value.id, provenance)?;
+            Some(value.id)
+        }
+        Command::SetAnalysisBase { property, binding } => {
+            let element = p.elements.get_mut(property).ok_or_else(missing)?;
+            let Some(SharedBody::EngineeringProperty { base, .. }) = element.shared_mut() else {
+                return Err(ModelError("SetAnalysisBase requires an engineering property.".into()));
+            };
+            *base = binding.clone();
+            Some(*property)
+        }
+        Command::SetAnalysisOverride { case, property, binding } => {
+            let element = p.elements.get_mut(case).ok_or_else(missing)?;
+            let Some(SharedBody::AnalysisCase { overrides, .. }) = element.shared_mut() else {
+                return Err(ModelError("SetAnalysisOverride requires an analysis case.".into()));
+            };
+            overrides.insert(*property, binding.clone());
+            Some(*case)
+        }
+        Command::ClearAnalysisOverride { case, property } => {
+            let target = p.elements.get(property).ok_or_else(missing)?;
+            if target.kind() != Kind::EngineeringProperty { return Err(ModelError("ClearAnalysisOverride requires an engineering property target.".into())); }
+            let layer = target.layer();
+            let element = p.elements.get_mut(case).ok_or_else(missing)?;
+            if element.layer() != layer { return Err(ModelError("Case and property must share a layer.".into())); }
+            let Some(SharedBody::AnalysisCase { overrides, .. }) = element.shared_mut() else {
+                return Err(ModelError("ClearAnalysisOverride requires an analysis case.".into()));
+            };
+            overrides.remove(property);
+            Some(*case)
+        }
         Command::CreateRelation(value) => {
             vacant(p, value.id)?;
             p.relations.insert(value.id, value.clone());
@@ -835,6 +891,10 @@ fn edit_header(
         assign(&mut p.name, &mut p.description, &mut p.alias);
         return Ok(());
     }
+    if let Some(v) = p.definitions.get_mut(&id) {
+        assign(&mut v.name, &mut v.description, &mut v.alias);
+        return Ok(());
+    }
     if let Some(v) = p.elements.get_mut(&id) {
         assign(&mut v.name, &mut v.description, &mut v.alias);
         return Ok(());
@@ -878,8 +938,13 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
         return Ok(());
     }
     vacant(p, new)?;
+    crate::analysis::references::check_remap(p, old, new)
+        .map_err(|error| ModelError(error.to_string()))?;
     if p.id == old {
         p.id = new;
+    } else if let Some(mut v) = p.definitions.remove(&old) {
+        v.id = new;
+        p.definitions.insert(new, v);
     } else if let Some(mut v) = p.elements.remove(&old) {
         v.id = new;
         p.elements.insert(new, v);
@@ -904,7 +969,7 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
             }
         }
     }
-    crate::references::remap_references(p, old, new);
+    crate::references::remap_references(p, old, new)?;
     Ok(())
 }
 fn layout(p: &mut Project, diagram: Id) -> Result<(), ModelError> {

crates/oa-core/src/source_defaults.rs

@@ -1,382 +0,0 @@
-//! Ordinary source defaults shared by current parsing and declaration rendering.
-//!
-//! These are source omission defaults, not graphical creation defaults. The
-//! policy operates on complete typed declaration maps. Required named fields
-//! and selected constructor payloads remain distinct from omission defaults.
-//! Historical versions use their existing frozen parser paths. Semantic baseline
-//! history is never traversed or normalized here.
-use crate::{Kind, RelationKind};
-use serde_json::{Map, Value, json};
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Context {
-    Element(Kind),
-    Relation(RelationKind),
-    Diagram,
-    Node,
-    Artifact,
-    Trace,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum Mode {
-    CompleteForEdit,
-    Compact,
-    /// Internal lossless-edit fragments: retain every top-level value while
-    /// compacting its selected constructor's optional nested fields.
-    CompactValues,
-}
-
-/// Top-level field inventory for the current ordinary reader. Callers must
-/// check required fields before merging; null entries only admit their names.
-/// This never supplies defaults inside a selected constructor.
-pub(crate) fn parser_fields(context: Context) -> Map<String, Value> {
-    let mut fields = declaration_defaults(context);
-    let required: &[&str] = match context {
-        Context::Element(kind) => {
-            fields.remove("description");
-            fields.remove("parent");
-            if kind == Kind::Port {
-                &["contract"]
-            } else {
-                &[]
-            }
-        }
-        Context::Relation(kind) => {
-            fields.remove("description");
-            match kind {
-                RelationKind::ContextualLink => &["owner", "source", "target", "purpose"],
-                RelationKind::FunctionalExchange => {
-                    &["source", "target", "source_port", "target_port"]
-                }
-                _ => &["source", "target"],
-            }
-        }
-        Context::Diagram => &[],
-        Context::Node => &["element"],
-        Context::Artifact => &["owner"],
-        Context::Trace => &["oa", "sa"],
-    };
-    for name in required {
-        fields.insert((*name).into(), Value::Null);
-    }
-    fields
-}
-
-pub(crate) fn fields(
-    context: Context,
-    input: &Map<String, Value>,
-    mode: Mode,
-) -> Map<String, Value> {
-    let mut result = input.clone();
-    restore_serialization_skips(context, &mut result);
-    if mode != Mode::CompleteForEdit {
-        compact_nested(context, &mut result);
-    }
-    if mode == Mode::Compact {
-        // Compact a composite and its declared default by the same nested rules
-        // before whole-field comparison. This also makes compact input stable:
-        // e.g. String{minimum_length:0} still denotes the default definition.
-        let mut defaults = declaration_defaults(context);
-        compact_nested(context, &mut defaults);
-        omit_defaults(&mut result, &defaults);
-    }
-    result
-}
-
-fn restore_serialization_skips(context: Context, fields: &mut Map<String, Value>) {
-    match context {
-        Context::Element(Kind::Occurrence) => {
-            if let Some(exchange) = constructor_payload(fields, "body", "Exchange") {
-                exchange
-                    .entry("operation".to_owned())
-                    .or_insert(Value::Null);
-            }
-        }
-        Context::Node => {
-            fields.entry("port_anchors".to_owned()).or_insert(json!([]));
-        }
-        Context::Trace => {
-            if let Some(baseline) = fields.get_mut("baseline").and_then(Value::as_object_mut) {
-                baseline.entry("semantic".to_owned()).or_insert(Value::Null);
-            }
-        }
-        _ => {}
-    }
-}
-
-fn declaration_defaults(context: Context) -> Map<String, Value> {
-    let mut defaults = match context {
-        Context::Element(kind) => element_defaults(kind),
-        Context::Relation(kind) => relation_defaults(kind),
-        Context::Diagram => object(json!({
-            "description": "", "layer": "Oa", "projection": "Overview",
-            "routes": [], "view_options": {
-                "hidden_edges": [], "relation_kinds": "All",
-                "work_categories": "All", "participant_categories": "All",
-                "coverage": "All", "work_contexts": "All", "exchange_labels": "Name"
-            }
-        })),
-        Context::Node => object(json!({
-            "position": {"x": 0.0, "y": 0.0},
-            "size": {"width": 224.0, "height": 94.0},
-            "collapsed": false, "port_anchors": []
-        })),
-        Context::Artifact => object(json!({
-            "description": "", "relation": "References", "uri": "",
-            "revision": null, "fragment": null
-        })),
-        Context::Trace => object(json!({
-            "description": "", "kind": "Refinement", "baseline": null
-        })),
-    };
-    match context {
-        Context::Element(_) => {
-            defaults.insert("description".into(), json!(""));
-            defaults.insert("parent".into(), Value::Null);
-        }
-        Context::Relation(_) => {
-            defaults.insert("description".into(), json!(""));
-        }
-        _ => {}
-    }
-    defaults
-}
-
-fn element_defaults(kind: Kind) -> Map<String, Value> {
-    if let Some(state_kind) = kind.state_kind() {
-        // The declaration selects this discriminator; no GUI factory is used.
-        return object(json!({
-            "kind": state_kind, "entry": "", "exit": "", "do_activity": ""
-        }));
-    }
-    match kind {
-        Kind::Process | Kind::FunctionalChain => object(json!({"steps": []})),
-        Kind::ExchangeItem => object(json!({
-            "kind": "Information", "mechanism": "Unspecified", "supertype": null
-        })),
-        Kind::ExchangeCategory => object(json!({"family": "Work", "exchanges": []})),
-        Kind::DataType => object(json!({
-            "definition": {"String": {"minimum_length": 0, "maximum_length": null}},
-            "default": null, "unit": ""
-        })),
-        Kind::DataField => object(json!({
-            "type_ref": "String", "minimum": 1, "maximum": 1, "unit": "",
-            "direction": "Unspecified", "storage": "Value", "default": null
-        })),
-        Kind::Interface => object(json!({"supertype": null})),
-        // Port.contract is required, even when its explicit value is Legacy.
-        Kind::Port => object(json!({"legacy": null})),
-        Kind::Scenario => object(json!({
-            "viewpoint": "MixedLegacy", "context": null,
-            "precondition": "", "postcondition": "", "steps": []
-        })),
-        Kind::Lifeline => object(json!({"represented": null})),
-        Kind::Occurrence => object(json!({
-            "body": {"Exchange": {
-                "exchange": null, "sender": null, "receiver": null,
-                "message_kind": "Asynchronous", "reply_to": null,
-                "values": [], "operation": null
-            }},
-            "precondition": "", "postcondition": ""
-        })),
-        Kind::Event => object(json!({"body": {"Signal": {"items": []}}})),
-        Kind::Constraint => object(json!({"expression": "", "constrained": []})),
-        // Unit-body declarations have no additional omission defaults. A future
-        // Kind reaches this branch without gaining speculative payload rules.
-        _ => Map::new(),
-    }
-}
-
-fn relation_defaults(kind: RelationKind) -> Map<String, Value> {
-    match kind {
-        RelationKind::InterfaceItemAllocation => object(json!({
-            "order": 0, "transmission": "Unspecified", "acquisition": "Unspecified"
-        })),
-        RelationKind::DataAssociation => object(json!({
-            "source_role": "", "target_role": "",
-            "source_minimum": 0, "target_minimum": 0,
-            "source_maximum": null, "target_maximum": null,
-            "source_navigable": false, "target_navigable": false
-        })),
-        RelationKind::Interaction | RelationKind::FunctionalExchange => {
-            object(json!({"items": []}))
-        }
-        RelationKind::BoundaryExchange => object(json!({"items": [], "oriented": true})),
-        RelationKind::CommunicationMean => object(json!({"items": [], "oriented": false})),
-        RelationKind::CapabilityExtend => object(json!({"condition": ""})),
-        RelationKind::SequenceLink => object(json!({"guard": ""})),
-        RelationKind::StateTransition => object(json!({
-            "transition_kind": "External", "trigger": "", "guard": "", "effect": "",
-            "triggers": [], "effects": []
-        })),
-        RelationKind::StateAction => object(json!({"phase": "Do"})),
-        // source/target, FunctionalExchange ports and ContextualLink's owner,
-        // endpoints and purpose are required, despite factory placeholder values.
-        _ => Map::new(),
-    }
-}
-
-fn compact_nested(context: Context, fields: &mut Map<String, Value>) {
-    match context {
-        Context::Element(Kind::DataType) => compact_data_definition(fields),
-        Context::Element(Kind::Port) => {
-            if let Some(legacy) = fields.get_mut("legacy").and_then(Value::as_object_mut) {
-                omit_nulls(legacy, &["interface"]);
-            }
-            // Every selected PortContract payload field remains required.
-        }
-        Context::Element(Kind::Occurrence) => compact_occurrence(fields),
-        Context::Diagram => {
-            if let Some(options) = fields
-                .get_mut("view_options")
-                .and_then(Value::as_object_mut)
-            {
-                omit_defaults(
-                    options,
-                    &object(json!({
-                        "hidden_edges": [], "relation_kinds": "All",
-                        "work_categories": "All", "participant_categories": "All",
-                        "coverage": "All", "work_contexts": "All", "exchange_labels": "Name"
-                    })),
-                );
-            }
-            if let Some(routes) = fields.get_mut("routes").and_then(Value::as_array_mut) {
-                for route in routes {
-                    if let Some(route) = route.as_object_mut() {
-                        omit_defaults(route, &object(json!({"waypoints": [], "label": null})));
-                    }
-                }
-            }
-            // Route entries, EdgeLabel coordinates, projection machine IDs, and
-            // Only([])/Any([]) selectors remain even when their values are empty.
-        }
-        Context::Trace => {
-            if let Some(baseline) = fields.get_mut("baseline").and_then(Value::as_object_mut) {
-                omit_nulls(baseline, &["semantic"]);
-            }
-            // No recursion through snapshots or semantic historical facets.
-        }
-        // DataValue/TypeRef payloads, EventBody fields, Node geometry/anchors,
-        // contextual endpoints/purposes, and other required records stay intact.
-        _ => {}
-    }
-}
-
-fn compact_data_definition(fields: &mut Map<String, Value>) {
-    for tag in ["Integer", "Real"] {
-        if let Some(payload) = constructor_payload(fields, "definition", tag) {
-            omit_nulls(payload, &["minimum", "maximum"]);
-        }
-    }
-    if let Some(payload) = constructor_payload(fields, "definition", "String") {
-        omit_nulls(payload, &["maximum_length"]);
-        // minimum_length is required inside a selected String constructor.
-    }
-    if let Some(payload) = constructor_payload(fields, "definition", "Record") {
-        omit_nulls(payload, &["supertype"]);
-    }
-    // Boolean has no payload; Enumeration.literals remains required even [].
-}
-
-fn compact_occurrence(fields: &mut Map<String, Value>) {
-    if let Some(exchange) = constructor_payload(fields, "body", "Exchange") {
-        omit_defaults(
-            exchange,
-            &object(json!({
-                "exchange": null, "sender": null, "receiver": null,
-                "message_kind": "Asynchronous", "reply_to": null,
-                "values": [], "operation": null
-            })),
-        );
-        if let Some(operation) = exchange.get_mut("operation").and_then(Value::as_object_mut) {
-            omit_nulls(operation, &["allocation"]);
-            // Keep the containing operation field even if its record becomes {}:
-            // explicit unresolved operation intent is not an absent operation.
-        }
-        if let Some(values) = exchange.get_mut("values").and_then(Value::as_array_mut) {
-            for value in values {
-                if let Some(message_value) = value.as_object_mut() {
-                    omit_defaults(message_value, &object(json!({"path": []})));
-                }
-            }
-        }
-        // MessageKind::Timer.expression, MessageValue.field/expression remain.
-    }
-    for (tag, optional) in [
-        ("Action", &["action", "lifeline"][..]),
-        ("State", &["state", "lifeline"][..]),
-        ("SequenceReference", &["sequence"][..]),
-        ("ScenarioUse", &["scenario"][..]),
-    ] {
-        if let Some(payload) = constructor_payload(fields, "body", tag) {
-            omit_nulls(payload, optional);
-        }
-    }
-    // ScenarioUse.bindings, Control.kind, Fragment.operator/branches and
-    // Branch.guard/occurrences are required, including empty strings/lists.
-}
-
-fn constructor_payload<'a>(
-    fields: &'a mut Map<String, Value>,
-    key: &str,
-    tag: &str,
-) -> Option<&'a mut Map<String, Value>> {
-    let wrapper = fields.get_mut(key)?.as_object_mut()?;
-    if wrapper.len() != 1 {
-        return None;
-    }
-    wrapper.get_mut(tag)?.as_object_mut()
-}
-
-fn omit_nulls(fields: &mut Map<String, Value>, names: &[&str]) {
-    for name in names {
-        if fields.get(*name).is_some_and(Value::is_null) {
-            fields.remove(*name);
-        }
-    }
-}
-
-fn omit_defaults(fields: &mut Map<String, Value>, defaults: &Map<String, Value>) {
-    for (name, default) in defaults {
-        if fields.get(name).is_some_and(|value| same(value, default)) {
-            fields.remove(name);
-        }
-    }
-}
-
-// Comparison recurses only to compare a known field with its exact declared
-// default. It never traverses arbitrary data looking for values to remove.
-fn same(value: &Value, default: &Value) -> bool {
-    match (value, default) {
-        (Value::Object(a), Value::Object(b)) => {
-            a.len() == b.len()
-                && a.iter()
-                    .all(|(key, value)| b.get(key).is_some_and(|d| same(value, d)))
-        }
-        (Value::Array(a), Value::Array(b)) => {
-            a.len() == b.len() && a.iter().zip(b).all(|(value, d)| same(value, d))
-        }
-        (Value::Number(a), Value::Number(b)) => {
-            // serde_json numeric equality alone can equate -0.0 with +0.0.
-            // Extracted f32 coordinates are represented exactly as f64 here.
-            a == b
-                && match (a.as_f64(), b.as_f64()) {
-                    (Some(x), Some(y)) if x == 0.0 && y == 0.0 => x.to_bits() == y.to_bits(),
-                    _ => true,
-                }
-        }
-        _ => value == default,
-    }
-}
-
-fn object(value: Value) -> Map<String, Value> {
-    match value {
-        Value::Object(fields) => fields,
-        _ => unreachable!("literal source default is an object"),
-    }
-}
-
-#[cfg(test)]
-#[path = "source_defaults_tests.rs"]
-mod tests;

crates/oa-core/src/source_defaults_tests.rs

@@ -1,718 +0,0 @@
-//! Independent literal oracles for the production source-default policy.
-use super::{self as policy, Context, Mode};
-use crate::{Kind, RelationKind};
-use serde_json::{Value, json};
-
-#[test]
-fn complete_comparison_keeps_populated_serializer_skip_values() {
-    for (context, input) in [
-        (
-            Context::Element(Kind::Occurrence),
-            json!({"body":{"Exchange":{"operation":{"allocation":"allocation-id"},"values":[]}}}),
-        ),
-        (
-            Context::Node,
-            json!({"port_anchors":[{"port":"port-id","side":"Left","offset":0.0}]}),
-        ),
-        (
-            Context::Trace,
-            json!({"baseline":{"semantic":{"historical":"payload"}}}),
-        ),
-    ] {
-        assert_eq!(rendered(context, &input, Mode::CompleteForEdit), input);
-    }
-}
-
-#[test]
-fn compact_value_fragments_keep_selected_constructor_requirements() {
-    for (context, input, expected) in [
-        (
-            Context::Element(Kind::DataType),
-            json!({"definition":{"String":{"minimum_length":0,"maximum_length":null}},"default":null,"unit":""}),
-            json!({"definition":{"String":{"minimum_length":0}},"default":null,"unit":""}),
-        ),
-        (
-            Context::Element(Kind::Event),
-            json!({"body":{"Signal":{"items":[]}}}),
-            json!({"body":{"Signal":{"items":[]}}}),
-        ),
-        (
-            Context::Element(Kind::Occurrence),
-            json!({"body":{"Exchange":{"operation":{"allocation":null},"values":[]}},"precondition":""}),
-            json!({"body":{"Exchange":{"operation":{}}},"precondition":""}),
-        ),
-        (
-            Context::Element(Kind::Occurrence),
-            json!({"body":{"ScenarioUse":{"scenario":null,"bindings":[]}}}),
-            json!({"body":{"ScenarioUse":{"bindings":[]}}}),
-        ),
-    ] {
-        assert_eq!(rendered(context, &input, Mode::CompactValues), expected);
-    }
-}
-
-#[test]
-fn source_scenario_default_is_independent_of_graphical_creation() {
-    use crate::{ElementBody, Layer, ScenarioViewpoint, SharedBody, language};
-    let project = language::parse(
-        "arcadia 7; project p \"P\" { oa_scenario o \"O\" {} sa_scenario s \"S\" {} }",
-    )
-    .unwrap();
-    for element in project.elements.values() {
-        assert!(matches!(
-            element.body.shared(),
-            Some(SharedBody::Scenario {
-                viewpoint: ScenarioViewpoint::MixedLegacy,
-                ..
-            })
-        ));
-        assert!(!matches!(
-            ElementBody::new(Kind::Scenario, element.layer())
-                .unwrap()
-                .shared(),
-            Some(SharedBody::Scenario {
-                viewpoint: ScenarioViewpoint::MixedLegacy,
-                ..
-            })
-        ));
-    }
-    let source = language::format(&project);
-    assert!(!source.contains("description"));
-    assert!(!source.contains("parent"));
-    assert!(!source.contains("viewpoint"));
-    assert_eq!(language::parse(&source).unwrap(), project);
-
-    let mut typed = project;
-    for element in typed.elements.values_mut() {
-        let viewpoint = if element.layer() == Layer::Oa {
-            ScenarioViewpoint::OperationalActivity
-        } else {
-            ScenarioViewpoint::Functional
-        };
-        *element.body.shared_mut().unwrap() = SharedBody::Scenario {
-            viewpoint,
-            context: None,
-            precondition: String::new(),
-            postcondition: String::new(),
-            steps: vec![],
-        };
-    }
-    let source = language::format(&typed);
-    assert!(source.contains("viewpoint OperationalActivity;"));
-    assert!(source.contains("viewpoint Functional;"));
-    assert_eq!(language::parse(&source).unwrap(), typed);
-}
-
-#[test]
-fn shared_parser_defaults_preserve_required_fields_and_kind_checks() {
-    for (declaration, message) in [
-        (
-            "oa_port p0 \"Port\" {}",
-            "Missing required field 'contract'",
-        ),
-        (
-            "allocation r \"R\" { source @owner; }",
-            "Missing required field 'target'",
-        ),
-        (
-            "functional_exchange r \"R\" { source @owner; target @work; }",
-            "Missing required field 'source_port'",
-        ),
-        (
-            "contextual_link r \"R\" {}",
-            "Missing required field 'owner'",
-        ),
-        ("node n { diagram @d; }", "Missing required field 'element'"),
-        ("artifact a \"A\" {}", "Missing required field 'owner'"),
-        ("trace t \"T\" {}", "Missing required field 'oa'"),
-        (
-            "oa_state s \"S\" { kind Initial; }",
-            "Declaration kind disagrees",
-        ),
-        (
-            "oa_activity a \"A\" { unknown true; }",
-            "Unknown field 'unknown'",
-        ),
-        (
-            "oa_data_type t \"T\" { definition { String {}; }; }",
-            "minimum_length",
-        ),
-        (
-            "oa_occurrence o \"O\" { body { ScenarioUse {}; }; }",
-            "bindings",
-        ),
-    ] {
-        let source = format!(
-            "arcadia 7; project p \"P\" {{ oa_entity owner \"Owner\" {{}} oa_activity work \"Work\" {{}} diagram d \"D\" {{}} {declaration} }}"
-        );
-        let errors = crate::language::parse(&source).unwrap_err();
-        assert!(
-            errors.iter().any(|error| error.message.contains(message)),
-            "{declaration}: {errors:?}"
-        );
-    }
-}
-
-fn rendered(context: Context, input: &Value, mode: Mode) -> Value {
-    Value::Object(policy::fields(context, input.as_object().unwrap(), mode))
-}
-
-fn compact(context: Context, input: Value, expected: Value) {
-    let original = input.clone();
-    let result = rendered(context, &input, Mode::Compact);
-    assert_eq!(result, expected, "context {context:?}");
-    assert_eq!(input, original, "the input remains immutable");
-    assert_eq!(
-        rendered(context, &result, Mode::Compact),
-        result,
-        "compact policy is idempotent"
-    );
-}
-
-#[test]
-fn complete_comparison_restores_only_the_three_known_skips() {
-    let exchange = json!({"body":{"Exchange":{"exchange":null,"sender":null,"receiver":null,"message_kind":"Asynchronous","reply_to":null,"values":[]}}});
-    let mut complete = exchange.clone();
-    complete["body"]["Exchange"]["operation"] = Value::Null;
-    assert_eq!(
-        rendered(
-            Context::Element(Kind::Occurrence),
-            &exchange,
-            Mode::CompleteForEdit
-        ),
-        complete
-    );
-    assert_eq!(
-        rendered(
-            Context::Node,
-            &json!({"element":"e","diagram":"d"}),
-            Mode::CompleteForEdit
-        ),
-        json!({"element":"e","diagram":"d","port_anchors":[]})
-    );
-    assert_eq!(
-        rendered(
-            Context::Trace,
-            &json!({"baseline":{"oa":{"name":"","description":""},"sa":{"name":"","description":""}}}),
-            Mode::CompleteForEdit
-        ),
-        json!({"baseline":{"oa":{"name":"","description":""},"sa":{"name":"","description":""},"semantic":null}})
-    );
-    for input in [
-        json!({"body":{"Action":{"action":null,"lifeline":null}}}),
-        json!({"body":{"State":{"state":null,"lifeline":null}}}),
-    ] {
-        assert_eq!(
-            rendered(
-                Context::Element(Kind::Occurrence),
-                &input,
-                Mode::CompleteForEdit
-            ),
-            input
-        );
-    }
-    for input in [
-        json!({"baseline":null}),
-        json!({"baseline":{"semantic":{"historical":[null,[],false,0,""]},"oa":{"name":"n","description":""},"sa":{"name":"s","description":""}}}),
-    ] {
-        assert_eq!(
-            rendered(Context::Trace, &input, Mode::CompleteForEdit),
-            input
-        );
-    }
-}
-
-#[test]
-fn every_element_omits_only_empty_common_defaults() {
-    for kind in Kind::ALL {
-        // Future/unknown payloads are preservation sentinels, not admitted source.
-        compact(
-            Context::Element(kind),
-            json!({"description":"","parent":null,"future":{"empty":[],"absent":null,"zero":0,"flag":false}}),
-            json!({"future":{"empty":[],"absent":null,"zero":0,"flag":false}}),
-        );
-        compact(
-            Context::Element(kind),
-            json!({"description":" \n","parent":"owner"}),
-            json!({"description":" \n","parent":"owner"}),
-        );
-    }
-}
-
-#[test]
-fn ordinary_element_defaults_are_context_specific() {
-    for kind in [Kind::Process, Kind::FunctionalChain] {
-        compact(Context::Element(kind), json!({"steps":[]}), json!({}));
-        compact(
-            Context::Element(kind),
-            json!({"steps":["second","first"]}),
-            json!({"steps":["second","first"]}),
-        );
-    }
-    compact(
-        Context::Element(Kind::ExchangeItem),
-        json!({"kind":"Information","mechanism":"Unspecified","supertype":null}),
-        json!({}),
-    );
-    compact(
-        Context::Element(Kind::ExchangeItem),
-        json!({"kind":"Energy","mechanism":"Flow","supertype":"base"}),
-        json!({"kind":"Energy","mechanism":"Flow","supertype":"base"}),
-    );
-    compact(
-        Context::Element(Kind::ExchangeCategory),
-        json!({"family":"Work","exchanges":[]}),
-        json!({}),
-    );
-    compact(
-        Context::Element(Kind::ExchangeCategory),
-        json!({"family":"Participant","exchanges":["x"]}),
-        json!({"family":"Participant","exchanges":["x"]}),
-    );
-    compact(
-        Context::Element(Kind::Interface),
-        json!({"supertype":null}),
-        json!({}),
-    );
-    compact(
-        Context::Element(Kind::Lifeline),
-        json!({"represented":null}),
-        json!({}),
-    );
-    compact(
-        Context::Element(Kind::Constraint),
-        json!({"expression":"","constrained":[]}),
-        json!({}),
-    );
-}
-
-#[test]
-fn scenario_source_default_never_uses_the_graphical_viewpoint_default() {
-    compact(
-        Context::Element(Kind::Scenario),
-        json!({"viewpoint":"MixedLegacy","context":null,"precondition":"","postcondition":"","steps":[]}),
-        json!({}),
-    );
-    for viewpoint in [
-        "OperationalActivity",
-        "Functional",
-        "ParticipantInteraction",
-        "BoundaryInterface",
-    ] {
-        compact(
-            Context::Element(Kind::Scenario),
-            json!({"viewpoint":viewpoint,"context":"scope","precondition":"ready","postcondition":"","steps":["two","one"]}),
-            json!({"viewpoint":viewpoint,"context":"scope","precondition":"ready","steps":["two","one"]}),
-        );
-    }
-}
-
-#[test]
-fn each_state_header_supplies_its_own_kind() {
-    for (kind, name) in [
-        (Kind::State, "State"),
-        (Kind::Mode, "Mode"),
-        (Kind::Initial, "Initial"),
-        (Kind::Final, "Final"),
-        (Kind::Choice, "Choice"),
-        (Kind::Junction, "Junction"),
-        (Kind::Fork, "Fork"),
-        (Kind::Join, "Join"),
-        (Kind::ShallowHistory, "ShallowHistory"),
-        (Kind::DeepHistory, "DeepHistory"),
-        (Kind::EntryPoint, "EntryPoint"),
-        (Kind::ExitPoint, "ExitPoint"),
-        (Kind::Terminate, "Terminate"),
-    ] {
-        compact(
-            Context::Element(kind),
-            json!({"kind":name,"entry":"","exit":"","do_activity":""}),
-            json!({}),
-        );
-    }
-    // Invalid mismatches must not be silently normalized by the writer policy.
-    compact(
-        Context::Element(Kind::Mode),
-        json!({"kind":"State","entry":"work"}),
-        json!({"kind":"State","entry":"work"}),
-    );
-}
-
-#[test]
-fn data_field_unbounded_and_present_empty_values_are_not_defaults() {
-    compact(
-        Context::Element(Kind::DataField),
-        json!({"type_ref":"String","minimum":1,"maximum":1,"unit":"","direction":"Unspecified","storage":"Value","default":null}),
-        json!({}),
-    );
-    compact(
-        Context::Element(Kind::DataField),
-        json!({"type_ref":{"Named":"record"},"minimum":0,"maximum":null,"unit":"m","direction":"Out","storage":"Reference","default":[]}),
-        json!({"type_ref":{"Named":"record"},"minimum":0,"maximum":null,"unit":"m","direction":"Out","storage":"Reference","default":[]}),
-    );
-    for value in [
-        json!({"Boolean":false}),
-        json!({"Integer":0}),
-        json!({"Real":0.0}),
-        json!({"String":""}),
-    ] {
-        compact(
-            Context::Element(Kind::DataField),
-            json!({"default":[value.clone()]}),
-            json!({"default":[value]}),
-        );
-    }
-}
-
-#[test]
-fn data_definition_whole_default_and_selected_required_fields_differ() {
-    compact(
-        Context::Element(Kind::DataType),
-        json!({"definition":{"String":{"minimum_length":0,"maximum_length":null}},"default":null,"unit":""}),
-        json!({}),
-    );
-    for (input, expected) in [
-        (
-            json!({"Integer":{"minimum":null,"maximum":null}}),
-            json!({"Integer":{}}),
-        ),
-        (
-            json!({"Real":{"minimum":null,"maximum":2.5}}),
-            json!({"Real":{"maximum":2.5}}),
-        ),
-        (
-            json!({"String":{"minimum_length":4,"maximum_length":null}}),
-            json!({"String":{"minimum_length":4}}),
-        ),
-        (json!({"Record":{"supertype":null}}), json!({"Record":{}})),
-        (
-            json!({"Enumeration":{"literals":[]}}),
-            json!({"Enumeration":{"literals":[]}}),
-        ),
-    ] {
-        compact(
-            Context::Element(Kind::DataType),
-            json!({"definition":input}),
-            json!({"definition":expected}),
-        );
-    }
-    compact(
-        Context::Element(Kind::DataType),
-        json!({"definition":"Boolean","default":{"Boolean":false}}),
-        json!({"definition":"Boolean","default":{"Boolean":false}}),
-    );
-}
-
-#[test]
-fn port_contract_and_its_required_payload_stay_explicit() {
-    compact(
-        Context::Element(Kind::Port),
-        json!({"contract":"Legacy","legacy":{"direction":"Out","interface":null}}),
-        json!({"contract":"Legacy","legacy":{"direction":"Out"}}),
-    );
-    for contract in [
-        json!({"FunctionInput":{"incoming_items":[]}}),
-        json!({"FunctionOutput":{"outgoing_items":[]}}),
-        json!({"Component":{"kind":"Standard","orientation":"Unset"}}),
-    ] {
-        compact(
-            Context::Element(Kind::Port),
-            json!({"contract":contract.clone(),"legacy":null}),
-            json!({"contract":contract}),
-        );
-    }
-}
-
-#[test]
-fn occurrence_whole_default_is_distinct_from_selected_constructor_payload() {
-    compact(
-        Context::Element(Kind::Occurrence),
-        json!({"body":{"Exchange":{"exchange":null,"sender":null,"receiver":null,"message_kind":"Asynchronous","reply_to":null,"values":[]}},"precondition":"","postcondition":""}),
-        json!({}),
-    );
-    for (input, expected) in [
-        (
-            json!({"Action":{"action":null,"lifeline":null}}),
-            json!({"Action":{}}),
-        ),
-        (
-            json!({"State":{"state":null,"lifeline":null}}),
-            json!({"State":{}}),
-        ),
-        (
-            json!({"SequenceReference":{"sequence":null}}),
-            json!({"SequenceReference":{}}),
-        ),
-        (
-            json!({"ScenarioUse":{"scenario":null,"bindings":[]}}),
-            json!({"ScenarioUse":{"bindings":[]}}),
-        ),
-        (
-            json!({"Branch":{"guard":"","occurrences":[]}}),
-            json!({"Branch":{"guard":"","occurrences":[]}}),
-        ),
-        (
-            json!({"Fragment":{"operator":"Parallel","branches":[]}}),
-            json!({"Fragment":{"operator":"Parallel","branches":[]}}),
-        ),
-        (
-            json!({"Control":{"kind":"Choice"}}),
-            json!({"Control":{"kind":"Choice"}}),
-        ),
-    ] {
-        compact(
-            Context::Element(Kind::Occurrence),
-            json!({"body":input}),
-            json!({"body":expected}),
-        );
-    }
-}
-
-#[test]
-fn unresolved_operation_and_required_message_value_are_preserved() {
-    compact(
-        Context::Element(Kind::Occurrence),
-        json!({"body":{"Exchange":{"exchange":null,"sender":null,"receiver":null,"message_kind":"Asynchronous","reply_to":null,"values":[{"field":"f","path":[],"expression":""}],"operation":{"allocation":null}}}}),
-        json!({"body":{"Exchange":{"values":[{"field":"f","expression":""}],"operation":{}}}}),
-    );
-    compact(
-        Context::Element(Kind::Occurrence),
-        json!({"body":{"Exchange":{"exchange":"flow","sender":"a","receiver":"b","message_kind":{"Timer":{"expression":""}},"reply_to":"request","values":[],"operation":null}}}),
-        json!({"body":{"Exchange":{"exchange":"flow","sender":"a","receiver":"b","message_kind":{"Timer":{"expression":""}},"reply_to":"request"}}}),
-    );
-}
-
-#[test]
-fn event_body_whole_default_does_not_prune_selected_required_fields() {
-    compact(
-        Context::Element(Kind::Event),
-        json!({"body":{"Signal":{"items":[]}}}),
-        json!({}),
-    );
-    for body in [
-        json!({"Signal":{"items":["i"]}}),
-        json!({"Time":{"kind":"After","expression":""}}),
-        json!({"Change":{"expression":""}}),
-    ] {
-        compact(
-            Context::Element(Kind::Event),
-            json!({"body":body.clone()}),
-            json!({"body":body}),
-        );
-    }
-}
-
-#[test]
-fn relation_required_endpoints_and_contextual_payloads_remain() {
-    for kind in RelationKind::ALL {
-        compact(
-            Context::Relation(kind),
-            json!({"description":"","source":"s","target":"t","future":[]}),
-            json!({"source":"s","target":"t","future":[]}),
-        );
-    }
-    compact(
-        Context::Relation(RelationKind::FunctionalExchange),
-        json!({"source":"s","target":"t","source_port":"sp","target_port":"tp","items":[]}),
-        json!({"source":"s","target":"t","source_port":"sp","target_port":"tp"}),
-    );
-    let contextual = json!({"owner":"o","source":{"references":[],"occurrence":"s"},"target":{"references":[],"occurrence":"t"},"purpose":{"Precedence":{"guard":""}}});
-    compact(
-        Context::Relation(RelationKind::ContextualLink),
-        contextual.clone(),
-        contextual,
-    );
-}
-
-#[test]
-fn relation_defaults_preserve_contextual_orientation_and_multiplicity() {
-    for (kind, orientation) in [
-        (RelationKind::BoundaryExchange, true),
-        (RelationKind::CommunicationMean, false),
-    ] {
-        compact(
-            Context::Relation(kind),
-            json!({"oriented":orientation,"items":[]}),
-            json!({}),
-        );
-        compact(
-            Context::Relation(kind),
-            json!({"oriented":!orientation}),
-            json!({"oriented":!orientation}),
-        );
-    }
-    compact(
-        Context::Relation(RelationKind::DataAssociation),
-        json!({"source_role":"","target_role":"","source_minimum":0,"target_minimum":0,"source_maximum":null,"target_maximum":null,"source_navigable":false,"target_navigable":false}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::DataAssociation),
-        json!({"source_maximum":0,"target_maximum":1,"source_navigable":true}),
-        json!({"source_maximum":0,"target_maximum":1,"source_navigable":true}),
-    );
-    compact(
-        Context::Relation(RelationKind::InterfaceItemAllocation),
-        json!({"order":0,"transmission":"Unspecified","acquisition":"Unspecified"}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::CapabilityExtend),
-        json!({"condition":""}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::SequenceLink),
-        json!({"guard":""}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::StateAction),
-        json!({"phase":"Do"}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::StateTransition),
-        json!({"transition_kind":"External","trigger":"","guard":"","effect":"","triggers":[],"effects":[]}),
-        json!({}),
-    );
-    compact(
-        Context::Relation(RelationKind::StateTransition),
-        json!({"transition_kind":"Internal","triggers":["t"],"effects":["e"]}),
-        json!({"transition_kind":"Internal","triggers":["t"],"effects":["e"]}),
-    );
-}
-
-#[test]
-fn diagram_options_remove_only_unrestricted_defaults() {
-    let defaults = json!({"hidden_edges":[],"relation_kinds":"All","work_categories":"All","participant_categories":"All","coverage":"All","work_contexts":"All","exchange_labels":"Name"});
-    compact(
-        Context::Diagram,
-        json!({"description":"","layer":"Oa","projection":"Overview","routes":[],"view_options":defaults}),
-        json!({}),
-    );
-    compact(
-        Context::Diagram,
-        json!({"layer":"Sa","projection":{"StateMachine":{"machine":"m"}},"view_options":{"hidden_edges":[],"relation_kinds":{"Only":[]},"work_categories":{"Any":[]},"participant_categories":"All","coverage":"All","work_contexts":{"Any":[]},"exchange_labels":"Name"}}),
-        json!({"layer":"Sa","projection":{"StateMachine":{"machine":"m"}},"view_options":{"relation_kinds":{"Only":[]},"work_categories":{"Any":[]},"work_contexts":{"Any":[]}}}),
-    );
-    compact(
-        Context::Diagram,
-        json!({"routes":[{"edge":"e","waypoints":[],"label":null}]}),
-        json!({"routes":[{"edge":"e"}]}),
-    );
-}
-
-#[test]
-fn node_whole_defaults_preserve_negative_zero_and_required_coordinates() {
-    compact(
-        Context::Node,
-        json!({"diagram":"d","element":"e","position":{"x":0.0,"y":0.0},"size":{"width":224.0,"height":94.0},"collapsed":false}),
-        json!({"diagram":"d","element":"e"}),
-    );
-    for position in [
-        json!({"x":-0.0,"y":0.0}),
-        json!({"x":0.0,"y":-0.0}),
-        json!({"x":1.0,"y":0.0}),
-    ] {
-        let result = rendered(
-            Context::Node,
-            &json!({"position":position.clone()}),
-            Mode::Compact,
-        );
-        assert_eq!(result, json!({"position":position.clone()}));
-        for coordinate in ["x", "y"] {
-            assert_eq!(
-                result["position"][coordinate].as_f64().unwrap().to_bits(),
-                position[coordinate].as_f64().unwrap().to_bits(),
-                "coordinate sign is part of fidelity"
-            );
-        }
-    }
-    compact(
-        Context::Node,
-        json!({"size":{"width":300.0,"height":94.0},"port_anchors":[{"port":"p","side":"Left","offset":0.0}]}),
-        json!({"size":{"width":300.0,"height":94.0},"port_anchors":[{"port":"p","side":"Left","offset":0.0}]}),
-    );
-}
-
-#[test]
-fn artifact_present_empty_strings_and_trace_history_stay_distinct() {
-    compact(
-        Context::Artifact,
-        json!({"owner":"o","description":"","relation":"References","uri":"","revision":null,"fragment":null}),
-        json!({"owner":"o"}),
-    );
-    compact(
-        Context::Artifact,
-        json!({"owner":"o","relation":"Implements","revision":"","fragment":""}),
-        json!({"owner":"o","relation":"Implements","revision":"","fragment":""}),
-    );
-    compact(
-        Context::Trace,
-        json!({"oa":"o","sa":"s","description":"","kind":"Refinement","baseline":null}),
-        json!({"oa":"o","sa":"s"}),
-    );
-    compact(
-        Context::Trace,
-        json!({"baseline":{"oa":{"name":"","description":""},"sa":{"name":"s","description":""}}}),
-        json!({"baseline":{"oa":{"name":"","description":""},"sa":{"name":"s","description":""}}}),
-    );
-    let baseline = json!({"oa":{"name":"o","description":""},"sa":{"name":"s","description":""},"semantic":{"facets":[{"Value":null},{"Value":[]},{"Value":false},{"Value":0},{"Value":""}]}});
-    compact(
-        Context::Trace,
-        json!({"kind":"Manual","baseline":baseline.clone()}),
-        json!({"kind":"Manual","baseline":baseline}),
-    );
-}
-
-#[test]
-fn nested_future_fields_prevent_whole_default_removal() {
-    // These sentinels exercise preservation, not current parser admission of
-    // unknown fields. Only known slots may lose their redundant defaults.
-    compact(
-        Context::Element(Kind::DataType),
-        json!({"definition":{"String":{"minimum_length":0,"maximum_length":null,"future":[]}}}),
-        json!({"definition":{"String":{"minimum_length":0,"future":[]}}}),
-    );
-    compact(
-        Context::Element(Kind::Occurrence),
-        json!({"body":{"Exchange":{"exchange":null,"sender":null,"receiver":null,"message_kind":"Asynchronous","reply_to":null,"values":[],"operation":null,"future":false}}}),
-        json!({"body":{"Exchange":{"future":false}}}),
-    );
-    compact(
-        Context::Diagram,
-        json!({"view_options":{"hidden_edges":[],"relation_kinds":"All","work_categories":"All","participant_categories":"All","coverage":"All","work_contexts":"All","exchange_labels":"Name","future":null}}),
-        json!({"view_options":{"future":null}}),
-    );
-}
-
-#[test]
-fn unknown_and_multikey_constructor_wrappers_are_not_reinterpreted() {
-    for definition in [
-        json!({"Future":{"minimum":null,"maximum":null}}),
-        json!({"String":{"minimum_length":0,"maximum_length":null},"Future":{}}),
-    ] {
-        compact(
-            Context::Element(Kind::DataType),
-            json!({"definition":definition.clone()}),
-            json!({"definition":definition}),
-        );
-    }
-    for body in [
-        json!({"Future":{"operation":null,"values":[]}}),
-        json!({"Exchange":{"exchange":null,"values":[]},"Future":{}}),
-    ] {
-        let fields = json!({"body":body});
-        assert_eq!(
-            rendered(
-                Context::Element(Kind::Occurrence),
-                &fields,
-                Mode::CompleteForEdit
-            ),
-            fields,
-            "do not invent a selected Exchange constructor in an unknown wrapper",
-        );
-        compact(Context::Element(Kind::Occurrence), fields.clone(), fields);
-    }
-}

crates/oa-core/src/source_files.rs

@@ -40,7 +40,6 @@ pub enum DiskExpectation {
 
 /// `bundle` retains detached and invalid buffers. Compile `reachable_bundle()`;
 /// use `diagnostics` to explain files that discovery could not read or parse.
-/// Diagnostic spans describe `bundle` bytes, including before UUID stabilization.
 /// Expectations always describe disk bytes before UUID stabilization.
 #[derive(Debug, Clone)]
 pub struct DiskProject {
@@ -527,11 +526,10 @@ pub fn discover_missing(
         result.expectations.keys().chain(result.bundle.files.keys()),
     )?;
     if result.diagnostics.is_empty() {
-        // Discovery retains raw editor bytes. Compilation may insert UUIDs or
-        // rewrite older syntax, so its returned locations belong to a different
-        // bundle. Lint still performs semantic migration and model validation;
-        // Open/Apply separately compile and install the rewritten source.
-        result.diagnostics = lint_bundle(&result.reachable_bundle(), limits);
+        match compile_bundle(&result.reachable_bundle(), limits) {
+            Ok(compiled) => result.diagnostics = compiled.diagnostics,
+            Err(diagnostics) => result.diagnostics = diagnostics,
+        }
     }
     let pending = journal_path(&result.root, &result.bundle.entry);
     if fs::symlink_metadata(&pending).is_ok() {

crates/oa-core/src/source_project.rs

@@ -726,8 +726,7 @@ fn apply_edits(bundle: &mut SourceBundle, edits: Edits) -> Result<(), Vec<Source
 pub fn format_bundle(project: &Project) -> SourceBundle {
     let ownership = default_ownership(project);
     let aliases: BTreeMap<_, _> = project.identities().into_iter().collect();
-    let mut declarations =
-        language::format_declarations(project, language::DeclarationFormat::Compact);
+    let mut declarations = language::format_declarations(project);
     declarations.sort_by_key(|(id, _)| declaration_order(project, *id, &aliases));
     let mut files: BTreeMap<LogicalPath, String> = BTreeMap::new();
     for (id, declaration) in declarations {
@@ -736,13 +735,11 @@ pub fn format_bundle(project: &Project) -> SourceBundle {
             .or_default()
             .push_str(&unindent(&declaration));
     }
-    let mut entry = format!("arcadia {SCHEMA_VERSION};\n{}{{\n", project_header(project));
-    if !project.description.is_empty() {
-        entry.push_str(&format!(
-            "    description {};\n",
-            quote(&project.description)
-        ));
-    }
+    let mut entry = format!(
+        "arcadia {SCHEMA_VERSION};\n{}{{\n    description {};\n",
+        project_header(project),
+        quote(&project.description)
+    );
     for path in files.keys() {
         entry.push_str(&format!("    include {};\n", quote(path)));
     }
@@ -853,25 +850,8 @@ pub fn update_bundle_with_identity_map(
         )]);
     }
     let origins: BTreeMap<_, _> = identities.iter().map(|(old, new)| (*new, *old)).collect();
-    // Comparison must include defaults even when persistence serialization or
-    // compact output omits them. Otherwise an unrelated payload edit erases
-    // unchanged explicit fields from the authored document.
-    let before: BTreeMap<_, _> =
-        language::format_declarations(old, language::DeclarationFormat::CompleteForEdit)
-            .into_iter()
-            .collect();
-    let after: BTreeMap<_, _> =
-        language::format_declarations(project, language::DeclarationFormat::CompleteForEdit)
-            .into_iter()
-            .collect();
-    let compact: BTreeMap<_, _> =
-        language::format_declarations(project, language::DeclarationFormat::Compact)
-            .into_iter()
-            .collect();
-    let compact_values: BTreeMap<_, _> =
-        language::format_declarations(project, language::DeclarationFormat::CompactValues)
-            .into_iter()
-            .collect();
+    let before: BTreeMap<_, _> = language::format_declarations(old).into_iter().collect();
+    let after: BTreeMap<_, _> = language::format_declarations(project).into_iter().collect();
     let old_aliases: BTreeMap<_, _> = old
         .identities()
         .into_iter()
@@ -927,27 +907,6 @@ pub fn update_bundle_with_identity_map(
             };
             let mut previous = parse(old_text)?;
             let mut next = parse(new_text)?;
-            let next_id = identities[&id];
-            let value_text = &compact_values[&next_id];
-            let insertion = InsertionSyntax::new(
-                &next.fields,
-                &parse(value_text)?.fields,
-                value_text,
-                &parse(&compact[&next_id])?.fields,
-            );
-            let old_kind = previous.header["kind"];
-            let new_kind = next.header["kind"];
-            if old_text[old_kind.start..old_kind.end] != new_text[new_kind.start..new_kind.end]
-                && let language::EditKind::Record(actual_fields) = &actual.fields.kind
-                && let language::EditKind::Record(previous_fields) = &mut previous.fields.kind
-            {
-                // An implicit value is supplied by its declaration context.
-                // After a kind change, an unchanged value may need explicit
-                // syntax (e.g. BoundaryExchange true -> CommunicationMean true).
-                // Reconsider only absent fields; authored explicit values still
-                // compare against their complete old values and keep trivia.
-                previous_fields.retain(|key, _| actual_fields.contains_key(key));
-            }
             if actual.lexical_owner.is_some()
                 && let language::EditKind::Record(fields) = &actual.fields.kind
                 && !fields.contains_key("parent")
@@ -964,7 +923,6 @@ pub fn update_bundle_with_identity_map(
                 source,
                 before: old_text,
                 after: new_text,
-                insertion: Some(&insertion),
                 old_aliases: &old_aliases,
                 new_aliases: &new_aliases,
                 legacy_value_paths: false,
@@ -995,7 +953,6 @@ pub fn update_bundle_with_identity_map(
             source,
             before: &before,
             after: &after,
-            insertion: None,
             old_aliases: &old_aliases,
             new_aliases: &new_aliases,
             legacy_value_paths: false,
@@ -1054,7 +1011,7 @@ pub fn update_bundle_with_identity_map(
         project,
         identities,
         &original_order,
-        &compact,
+        &after,
         limits,
     )?;
     let result = compile_bundle(&bundle, limits)?;
@@ -1162,73 +1119,10 @@ fn inserted_value(text: &str, indent: &str, source: &str) -> String {
     output
 }
 
-// Value fragments retain required payload fields even when the enclosing
-// declaration field is itself omittable. For example, a selected String type
-// needs minimum_length; an Event Signal needs items. The complete tree remains
-// the comparison authority; this parallel tree is only an insertion template.
-struct InsertionSyntax<'a> {
-    source: &'a str,
-    values: BTreeMap<usize, Span>,
-    omitted_fields: BTreeSet<usize>,
-}
-impl<'a> InsertionSyntax<'a> {
-    fn new(
-        complete: &language::EditValue,
-        compact_values: &language::EditValue,
-        source: &'a str,
-        compact: &language::EditValue,
-    ) -> Self {
-        let mut result = Self {
-            source,
-            values: BTreeMap::new(),
-            omitted_fields: BTreeSet::new(),
-        };
-        result.collect(complete, compact_values);
-        if let (language::EditKind::Record(all), language::EditKind::Record(kept)) =
-            (&complete.kind, &compact.kind)
-        {
-            for (key, field) in all {
-                if !kept.contains_key(key) {
-                    result.omitted_fields.insert(field.value.span.start);
-                }
-            }
-        }
-        result
-    }
-    fn collect(&mut self, complete: &language::EditValue, compact: &language::EditValue) {
-        // Borrow the existing compact text once. Copying each containing record
-        // here would duplicate a large nested payload at every depth.
-        self.values.insert(complete.span.start, compact.span);
-        match (&complete.kind, &compact.kind) {
-            (language::EditKind::Record(all), language::EditKind::Record(kept)) => {
-                for (key, field) in all {
-                    if let Some(next) = kept.get(key) {
-                        self.collect(&field.value, &next.value);
-                    } else {
-                        self.omitted_fields.insert(field.value.span.start);
-                    }
-                }
-            }
-            (language::EditKind::List(all), language::EditKind::List(kept)) => {
-                assert_eq!(
-                    all.len(),
-                    kept.len(),
-                    "compaction preserves array membership"
-                );
-                for (field, next) in all.iter().zip(kept) {
-                    self.collect(field, next);
-                }
-            }
-            _ => {}
-        }
-    }
-}
-
 struct SyntaxUpdate<'a> {
     source: &'a str,
     before: &'a str,
     after: &'a str,
-    insertion: Option<&'a InsertionSyntax<'a>>,
     old_aliases: &'a BTreeMap<String, String>,
     new_aliases: &'a BTreeMap<String, String>,
     // Source3 migration only adds path qualification; the existing field identity
@@ -1237,16 +1131,6 @@ struct SyntaxUpdate<'a> {
     identity_origins: Option<&'a BTreeMap<Id, Id>>,
 }
 impl SyntaxUpdate<'_> {
-    fn inserted(&self, value: &language::EditValue) -> &str {
-        self.insertion
-            .and_then(|syntax| {
-                syntax
-                    .values
-                    .get(&value.span.start)
-                    .map(|span| &syntax.source[span.start..span.end])
-            })
-            .unwrap_or(&self.after[value.span.start..value.span.end])
-    }
     fn header(
         &self,
         actual: &BTreeMap<&str, Span>,
@@ -1359,7 +1243,7 @@ impl SyntaxUpdate<'_> {
             _ => {
                 erase_syntax(self.source, actual.span, edits);
                 let text = inserted_value(
-                    self.inserted(after),
+                    &self.after[after.span.start..after.span.end],
                     indent_at(self.source, actual.span.start),
                     self.source,
                 );
@@ -1424,9 +1308,6 @@ impl SyntaxUpdate<'_> {
             .iter()
             .filter(|(key, field)| {
                 !actual.contains_key(*key)
-                    && self.insertion.is_none_or(|syntax| {
-                        !syntax.omitted_fields.contains(&field.value.span.start)
-                    })
                     && before
                         .and_then(|fields| fields.get(*key))
                         .is_none_or(|old| !self.same(&old.value, &field.value))
@@ -1445,7 +1326,11 @@ impl SyntaxUpdate<'_> {
             .unwrap_or_else(|| format!("{}    ", indent_at(self.source, span.start)));
         let mut text = String::new();
         for (key, field) in added {
-            let value = inserted_value(self.inserted(&field.value), &indent, self.source);
+            let value = inserted_value(
+                &self.after[field.value.span.start..field.value.span.end],
+                &indent,
+                self.source,
+            );
             if multiline {
                 text.push_str(&indent);
                 text.push_str(&format!("{key} {value};{}", newline(self.source)));
@@ -1565,7 +1450,11 @@ impl SyntaxUpdate<'_> {
                 } else {
                     text.push(' ');
                 }
-                text.push_str(&inserted_value(self.inserted(next), &indent, self.source));
+                text.push_str(&inserted_value(
+                    &self.after[next.span.start..next.span.end],
+                    &indent,
+                    self.source,
+                ));
                 suffix = "";
             }
             if i + 1 < after.len() {

crates/oa-core/src/source_project/source_migration.rs

@@ -11,10 +11,7 @@ pub(super) fn upgrade(
         .as_ref()
         .expect("an explicit source migration report");
     let project = &current.decoded.project;
-    let canonical: BTreeMap<_, _> =
-        language::format_declarations(project, language::DeclarationFormat::CompleteForEdit)
-            .into_iter()
-            .collect();
+    let canonical: BTreeMap<_, _> = language::format_declarations(project).into_iter().collect();
     let changed: BTreeSet<_> = report
         .semantic_defaults
         .iter()
@@ -62,7 +59,6 @@ pub(super) fn upgrade(
                 source,
                 before: source,
                 after,
-                insertion: None,
                 old_aliases: &aliases,
                 new_aliases: &aliases,
                 legacy_value_paths: true,

crates/oa-core/src/transitions.rs

@@ -449,6 +449,13 @@ pub fn plan_transition(
     request: &TransitionRequest,
 ) -> Result<TransitionPlan, ModelError> {
     validate_candidate(project)?;
+    let is_analysis = |id: &Id| project.elements.get(id).is_some_and(|element| element.kind().is_analysis());
+    if request.sources.iter().any(is_analysis)
+        || request.mappings.iter().any(|mapping| is_analysis(&mapping.source)
+            || mapping.target.as_ref().is_some_and(is_analysis)
+            || mapping.target_kind.is_some_and(Kind::is_analysis)) {
+        return Err(ModelError("Analysis transition semantics are not implemented; copying or reviewing only record headers is refused.".into()));
+    }
     let mut plan = TransitionPlan {
         base_fingerprint: project_fingerprint(project),
         request: request.clone(),
@@ -608,6 +615,9 @@ pub fn plan_transition(
             }
         }
     }
+    if selected.iter().any(is_analysis) {
+        return Err(ModelError("Transition dependency closure includes analysis records; explicit analysis transition semantics are required.".into()));
+    }
     selected.retain(|id| {
         if omitted.contains(id) {
             if reported_omissions.insert(*id) { plan.warnings.push(format!("SA-only omission: {} ({id}) has no OA port counterpart; the original is preserved.", project.named(*id))); }

crates/oa-core/src/validation.rs

@@ -180,6 +180,18 @@ fn check_ids(out: &mut Vec<Issue>, owner: Id, field: &str, ids: &[Id]) {
 }
 
 pub fn validate(p: &Project) -> Vec<Issue> {
+    // Bound analysis trees before architectural visitors can clone an element.
+    // Admission itself never enters this public validator recursively.
+    if let Err(failure) = crate::analysis::admit_structure_checked(p, crate::analysis::AdmissionLimits::REFERENCE) {
+        let mut out = Vec::new();
+        error(&mut out, failure.object, &failure.code, &failure.field, failure.message);
+        return out;
+    }
+    validate_structure(p)
+}
+
+/// Architecture/header validation without recursively re-entering analysis admission.
+pub(crate) fn validate_structure(p: &Project) -> Vec<Issue> {
     let mut out = Vec::new();
     let coverage = coverage::Index::new(p);
     let topology_index = crate::topology_context::TopologyIndex::new(p);

crates/oa-core/tests/default_omission_admission.rs

@@ -1,344 +0,0 @@
-//! Existing source-7 nested omission compatibility, independently of formatting.
-//!
-//! Selected constructors use their own field contracts. These handwritten
-//! sources and literal models distinguish nullable optional slots from required
-//! fields; they do not prescribe compact canonical output or broaden admission.
-
-use oa_core::{source_project::*, *};
-use std::collections::BTreeMap;
-
-fn id(number: u8) -> Id {
-    Id::parse_str(&format!("00000000-0000-4000-8000-{number:012}")).unwrap()
-}
-
-fn bundle(declarations: &str) -> SourceBundle {
-    let source = format!(
-        "arcadia 7;\nproject p \"Admission\" id \"00000000-0000-4000-8000-000000000001\" {{\n{declarations}\n}}\n"
-    );
-    SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), source)]),
-    }
-}
-
-fn element(number: u8, alias: &str, name: &str, parent: Option<Id>, body: ElementBody) -> Element {
-    Element {
-        id: id(number),
-        alias: alias.into(),
-        name: name.into(),
-        description: String::new(),
-        parent,
-        body,
-    }
-}
-
-fn assert_admitted(input: &SourceBundle, elements: Vec<Element>) -> Project {
-    let expected = Project {
-        schema_version: 7,
-        id: id(1),
-        alias: "p".into(),
-        name: "Admission".into(),
-        description: String::new(),
-        elements: elements.into_iter().map(|e| (e.id, e)).collect(),
-        relations: BTreeMap::new(),
-        diagrams: BTreeMap::new(),
-        artifact_links: BTreeMap::new(),
-        traces: BTreeMap::new(),
-    };
-    let compiled = compile_bundle(input, ProjectLimits::default()).unwrap();
-    assert_eq!(compiled.decoded.project, expected, "complete literal model");
-    assert_eq!(
-        compiled.bundle, *input,
-        "fixed IDs require no source stabilization"
-    );
-    compiled.decoded.project
-}
-
-fn prefix(layer: Layer) -> &'static str {
-    match layer {
-        Layer::Oa => "oa",
-        Layer::Sa => "sa",
-    }
-}
-
-fn data_bundle(layer: Layer, definition: &str) -> SourceBundle {
-    bundle(&format!(
-        "    {}_data_type subject \"Subject\" id \"00000000-0000-4000-8000-000000000002\" {{ definition {{ {definition}; }}; }}",
-        prefix(layer)
-    ))
-}
-
-fn admit_data(layer: Layer, source: &str, definition: DataTypeDefinition) -> Project {
-    assert_admitted(
-        &data_bundle(layer, source),
-        vec![element(
-            2,
-            "subject",
-            "Subject",
-            None,
-            ElementBody::shared_in(
-                layer,
-                SharedBody::DataType {
-                    definition,
-                    default: None,
-                    unit: String::new(),
-                },
-            ),
-        )],
-    )
-}
-
-fn assert_missing(input: &SourceBundle, field: &str) {
-    let errors = compile_bundle(input, ProjectLimits::default()).unwrap_err();
-    assert_eq!(
-        errors.len(),
-        1,
-        "expect the targeted admission error: {errors:?}"
-    );
-    let diagnostic = &errors[0].diagnostic;
-    assert_eq!(diagnostic.code, "invalid_source", "{errors:?}");
-    assert!(
-        diagnostic.message.to_lowercase().contains("missing") && diagnostic.message.contains(field),
-        "must reject the missing constructor field {field}, not an unrelated model rule: {errors:?}"
-    );
-}
-
-#[test]
-fn integer_optional_bounds_can_be_omitted_individually_and_together() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for (omitted, explicit, minimum, maximum) in [
-            (
-                "Integer {}",
-                "Integer { minimum none; maximum none; }",
-                None,
-                None,
-            ),
-            (
-                "Integer { maximum 9; }",
-                "Integer { minimum none; maximum 9; }",
-                None,
-                Some(9),
-            ),
-            (
-                "Integer { minimum -3; }",
-                "Integer { minimum -3; maximum none; }",
-                Some(-3),
-                None,
-            ),
-        ] {
-            let expected = DataTypeDefinition::Integer { minimum, maximum };
-            assert_eq!(
-                admit_data(layer, omitted, expected.clone()),
-                admit_data(layer, explicit, expected),
-                "omitted and explicit optional Integer bounds agree"
-            );
-        }
-    }
-}
-
-#[test]
-fn real_optional_bounds_can_be_omitted_individually_and_together() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        for (omitted, explicit, minimum, maximum) in [
-            (
-                "Real {}",
-                "Real { minimum none; maximum none; }",
-                None,
-                None,
-            ),
-            (
-                "Real { maximum 2.5; }",
-                "Real { minimum none; maximum 2.5; }",
-                None,
-                Some(2.5),
-            ),
-            (
-                "Real { minimum -1.25; }",
-                "Real { minimum -1.25; maximum none; }",
-                Some(-1.25),
-                None,
-            ),
-        ] {
-            let expected = DataTypeDefinition::Real { minimum, maximum };
-            assert_eq!(
-                admit_data(layer, omitted, expected.clone()),
-                admit_data(layer, explicit, expected),
-                "omitted and explicit optional Real bounds agree"
-            );
-        }
-    }
-}
-
-#[test]
-fn string_optional_maximum_can_be_omitted_without_resetting_required_minimum() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let expected = DataTypeDefinition::String {
-            minimum_length: 4,
-            maximum_length: None,
-        };
-        assert_eq!(
-            admit_data(layer, "String { minimum_length 4; }", expected.clone()),
-            admit_data(
-                layer,
-                "String { minimum_length 4; maximum_length none; }",
-                expected,
-            ),
-        );
-    }
-}
-
-#[test]
-fn explicitly_selected_string_requires_minimum_even_when_whole_definition_has_a_default() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert_missing(&data_bundle(layer, "String {}"), "minimum_length");
-        assert_missing(
-            &data_bundle(layer, "String { maximum_length none; }"),
-            "minimum_length",
-        );
-        admit_data(
-            layer,
-            "String { minimum_length 0; }",
-            DataTypeDefinition::String {
-                minimum_length: 0,
-                maximum_length: None,
-            },
-        );
-    }
-}
-
-#[test]
-fn absent_numeric_maximum_is_distinct_from_an_explicit_zero_bound() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let unbounded = admit_data(
-            layer,
-            "Integer { minimum -3; }",
-            DataTypeDefinition::Integer {
-                minimum: Some(-3),
-                maximum: None,
-            },
-        );
-        let bounded = admit_data(
-            layer,
-            "Integer { minimum -3; maximum 0; }",
-            DataTypeDefinition::Integer {
-                minimum: Some(-3),
-                maximum: Some(0),
-            },
-        );
-        assert_ne!(unbounded, bounded, "zero is a bound, not omitted syntax");
-    }
-}
-
-#[test]
-fn record_has_no_required_payload_field_and_omitted_supertype_means_none() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let expected = DataTypeDefinition::Record { supertype: None };
-        assert_eq!(
-            admit_data(layer, "Record {}", expected.clone()),
-            admit_data(layer, "Record { supertype none; }", expected),
-        );
-        let errors = compile_bundle(
-            &data_bundle(layer, "Record { fields []; }"),
-            ProjectLimits::default(),
-        )
-        .unwrap_err();
-        assert_eq!(errors.len(), 1, "{errors:?}");
-        assert_eq!(errors[0].diagnostic.code, "invalid_source", "{errors:?}");
-        assert!(
-            errors[0]
-                .diagnostic
-                .message
-                .contains("unknown field `fields`"),
-            "Record remains a closed constructor: {errors:?}"
-        );
-    }
-}
-
-#[test]
-fn enumeration_still_requires_its_list_even_when_empty_list_is_admitted() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert_missing(&data_bundle(layer, "Enumeration {}"), "literals");
-        admit_data(
-            layer,
-            "Enumeration { literals []; }",
-            DataTypeDefinition::Enumeration { literals: vec![] },
-        );
-    }
-}
-
-fn port_bundle(layer: Layer, fields: &str) -> SourceBundle {
-    let owner_kind = match layer {
-        Layer::Oa => "oa_entity",
-        Layer::Sa => "sa_system",
-    };
-    bundle(&format!(
-        "    {owner_kind} owner \"Owner\" id \"00000000-0000-4000-8000-000000000002\" {{}}\n    {}_port subject \"Subject\" id \"00000000-0000-4000-8000-000000000003\" {{ parent @owner; {fields} }}",
-        prefix(layer)
-    ))
-}
-
-fn admit_port(layer: Layer, fields: &str) -> Project {
-    let owner_body = match layer {
-        Layer::Oa => ElementBody::Oa(OaBody::Entity),
-        Layer::Sa => ElementBody::Sa(SaBody::System),
-    };
-    assert_admitted(
-        &port_bundle(layer, fields),
-        vec![
-            element(2, "owner", "Owner", None, owner_body),
-            element(
-                3,
-                "subject",
-                "Subject",
-                Some(id(2)),
-                ElementBody::shared_in(
-                    layer,
-                    SharedBody::Port {
-                        contract: PortContract::Legacy,
-                        legacy: Some(LegacyPortContract {
-                            direction: PortDirection::Out,
-                            interface: None,
-                        }),
-                    },
-                ),
-            ),
-        ],
-    )
-}
-
-#[test]
-fn legacy_port_interface_can_be_omitted_but_preserves_direction() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert_eq!(
-            admit_port(layer, "contract Legacy; legacy { direction Out; };"),
-            admit_port(
-                layer,
-                "contract Legacy; legacy { direction Out; interface none; };"
-            ),
-        );
-    }
-}
-
-#[test]
-fn legacy_port_direction_remains_required_inside_selected_record() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert_missing(
-            &port_bundle(layer, "contract Legacy; legacy {};"),
-            "direction",
-        );
-        assert_missing(
-            &port_bundle(layer, "contract Legacy; legacy { interface none; };"),
-            "direction",
-        );
-    }
-}
-
-#[test]
-fn port_declaration_still_requires_explicit_contract() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert_missing(
-            &port_bundle(layer, "legacy { direction Out; };"),
-            "contract",
-        );
-    }
-}

crates/oa-core/tests/default_omission_fidelity.rs

@@ -1,445 +0,0 @@
-//! Public flat/modular formatter fidelity over frozen input and bounded mutations.
-//! Legacy fixture migration uses the public parser. The original adapter tests
-//! and exact inputs remain archived at source commit 2a64344; this suite exercises
-//! production formatters, not that frozen experiment or lossless model edits.
-
-use oa_core::{language, source_project::*, *};
-use std::collections::BTreeMap;
-
-const COASTAL: &str = include_str!("../../../examples/coastal-rescue.arcadia");
-const KEYED: &str =
-    include_str!("../../../harness/fixtures/release1-native/semantic-keyed.arcadia");
-const STATES: &str =
-    include_str!("../../../harness/fixtures/release1-native/state-actions.arcadia");
-const DENSE: &str =
-    include_str!("../../../harness/fixtures/release1-native/dense-40/dense-40.arcadia");
-const OPERATIONS: &str = include_str!(
-    "../../../harness/fixtures/interface-operation-probe/output/boundary-only.arcadia"
-);
-
-fn read(source: &str) -> Project {
-    language::parse(source).unwrap()
-}
-
-fn identity(project: &Project, alias: &str) -> Id {
-    project
-        .identities()
-        .into_iter()
-        .find(|(_, name)| *name == alias)
-        .unwrap()
-        .0
-}
-
-fn assert_common_omissions(project: &Project, compiled: &CompiledSourceProject) {
-    if project.description.is_empty() {
-        assert!(compiled.index.project_description.is_none());
-    }
-    let descriptions = project
-        .elements
-        .values()
-        .map(|e| (e.id, &e.description))
-        .chain(project.relations.values().map(|r| (r.id, &r.description)))
-        .chain(project.diagrams.values().map(|d| (d.id, &d.description)))
-        .chain(
-            project
-                .artifact_links
-                .values()
-                .map(|a| (a.id, &a.description)),
-        )
-        .chain(project.traces.values().map(|t| (t.id, &t.description)));
-    for (id, description) in descriptions {
-        if description.is_empty() {
-            assert!(
-                !compiled
-                    .index
-                    .fields
-                    .contains_key(&(id, "description".into()))
-            );
-        }
-    }
-    for element in project.elements.values().filter(|e| e.parent.is_none()) {
-        assert!(
-            !compiled
-                .index
-                .fields
-                .contains_key(&(element.id, "parent".into()))
-        );
-    }
-}
-
-fn assert_fidelity(label: &str, project: &Project) -> (Project, String) {
-    let flat = language::format(project);
-    let compact_model = read(&flat);
-    assert_eq!(
-        compact_model, *project,
-        "{label}: every persistent field survives"
-    );
-
-    let input = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), flat.clone())]),
-    };
-    let compiled = compile_bundle(&input, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        compiled.decoded.project, *project,
-        "{label}: source-project compile"
-    );
-    assert_eq!(
-        compiled.bundle, input,
-        "{label}: compact identities/source are stable"
-    );
-
-    assert_common_omissions(project, &compiled);
-    assert_eq!(
-        language::format(&compact_model),
-        flat,
-        "{label}: flat idempotence"
-    );
-
-    let modular = format_bundle(project);
-    assert!(
-        modular.files.len() > 1,
-        "{label}: exercise generated includes"
-    );
-    let modular_compiled = compile_bundle(&modular, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        modular_compiled.decoded.project, *project,
-        "{label}: complete modular model"
-    );
-    assert_eq!(
-        modular_compiled.bundle, modular,
-        "{label}: modular source/IDs are stable"
-    );
-    assert_common_omissions(project, &modular_compiled);
-    assert_eq!(
-        format_bundle(&compact_model),
-        modular,
-        "{label}: flat-to-modular determinism"
-    );
-    assert_eq!(
-        format_bundle(&modular_compiled.decoded.project),
-        modular,
-        "{label}: modular idempotence"
-    );
-
-    // Pinned measured compact bytes from the published fidelity-1 stderr.log at
-    // 2a64344, not a comparison against today's (now compact) canonical writer.
-    // A small header-layout allowance avoids enforcing incidental blank lines.
-    let measured_compact_bytes = match label {
-        "coastal-source3" => 28_465,
-        "keyed-source5-history" => 12_066,
-        "state-actions-source5" => 6_673,
-        "dense40-source6" => 19_342,
-        "boundary-operations-source6" => 3_660,
-        "state-negative-zero" => 6_672,
-        "keyed-present-empty-default" => 12_108,
-        "coastal-present-empty-artifact-strings" => 28_483,
-        "boundary-selected-and-unresolved-operations" => 3_806,
-        _ => panic!("missing independent compact measurement for {label}"),
-    };
-    assert!(
-        flat.len() <= measured_compact_bytes + 16,
-        "{label}: {} bytes exceeds compact evidence budget {}",
-        flat.len(),
-        measured_compact_bytes + 16
-    );
-    (compact_model, flat)
-}
-
-#[test]
-fn migrated_coastal_oa_sa_views_ports_artifacts_and_traces_roundtrip() {
-    assert!(COASTAL.starts_with("arcadia 3;"));
-    let project = read(COASTAL);
-    assert!(project.elements.values().any(|e| e.layer() == Layer::Oa));
-    assert!(project.elements.values().any(|e| e.layer() == Layer::Sa));
-    assert!(
-        project
-            .elements
-            .values()
-            .any(|e| matches!(e.shared(), Some(SharedBody::Port { .. })))
-    );
-    assert!(project.elements.values().any(
-        |e| matches!(e.shared(), Some(SharedBody::Scenario { steps, .. }) if !steps.is_empty())
-    ));
-    assert!(project.diagrams.values().any(|d| d.layer == Layer::Oa
-        && d.projection == ProjectionKind::FunctionalDataflow
-        && !d.nodes.is_empty()));
-    assert!(project.diagrams.values().any(|d| d.layer == Layer::Sa
-        && d.projection == ProjectionKind::Allocation
-        && !d.nodes.is_empty()));
-    assert!(!project.artifact_links.is_empty());
-    assert!(project.traces.values().any(|t| t.baseline.is_some()));
-    assert_fidelity("coastal-source3", &project);
-}
-
-#[test]
-fn keyed_scenarios_records_and_historical_binding_annotation_facets_roundtrip() {
-    let project = read(KEYED);
-    for layer in [Layer::Oa, Layer::Sa] {
-        assert!(project.elements.values().any(|e| e.layer() == layer
-            && matches!(
-                e.shared(),
-                Some(SharedBody::DataType {
-                    definition: DataTypeDefinition::Record { .. },
-                    ..
-                })
-            )));
-        assert!(project.elements.values().any(|e| e.layer() == layer && matches!(e.shared(), Some(SharedBody::Occurrence { body: OccurrenceBody::ScenarioUse { bindings, .. }, .. }) if !bindings.is_empty())));
-    }
-    assert!(project.elements.values().any(|e| matches!(e.shared(), Some(SharedBody::Occurrence { body: OccurrenceBody::Exchange { values, .. }, .. }) if values.iter().any(|v| !v.path.is_empty() && !v.expression.is_empty()))));
-    let facets: Vec<_> = project
-        .traces
-        .values()
-        .filter_map(|t| t.baseline.as_ref()?.semantic.as_ref())
-        .flat_map(|baseline| &baseline.facets)
-        .collect();
-    assert!(
-        facets
-            .iter()
-            .any(|facet| matches!(facet, semantic::FacetReview::Binding { .. }))
-    );
-    assert!(
-        facets
-            .iter()
-            .any(|facet| matches!(facet, semantic::FacetReview::Annotation { .. }))
-    );
-    assert!(
-        KEYED.contains("uuid \""),
-        "fixture contains historical identity atoms"
-    );
-    let (_, source) = assert_fidelity("keyed-source5-history", &project);
-    assert!(
-        source.contains("uuid \""),
-        "historical atoms remain historical"
-    );
-}
-
-#[test]
-fn state_machine_projection_typed_actions_and_bounded_integer_roundtrip() {
-    let project = read(STATES);
-    let machine = identity(&project, "operating");
-    let view = &project.diagrams[&identity(&project, "state_view")];
-    assert_eq!(view.projection, ProjectionKind::StateMachine { machine });
-    assert!(!view.nodes.is_empty());
-    for phase in [
-        StateActionKind::Entry,
-        StateActionKind::Do,
-        StateActionKind::Exit,
-    ] {
-        assert!(project.relations.values().any(|r| matches!(&r.body, RelationBody::StateAction { phase: actual, .. } if *actual == phase)));
-    }
-    assert!(project.relations.values().any(|r| matches!(&r.body, RelationBody::StateTransition { transition_kind: TransitionKind::Internal, triggers, effects, .. } if !triggers.is_empty() && !effects.is_empty())));
-    assert!(
-        matches!(project.elements[&identity(&project, "retry_budget")].shared(), Some(SharedBody::DataType { definition: DataTypeDefinition::Integer { minimum: Some(0), maximum: Some(4) }, unit, .. }) if unit == "attempts")
-    );
-    assert_fidelity("state-actions-source5", &project);
-}
-
-#[test]
-fn forty_exchange_diagram_with_categories_and_processes_roundtrip() {
-    let project = read(DENSE);
-    assert_eq!(
-        project
-            .relations
-            .values()
-            .filter(|r| r.kind() == RelationKind::Interaction)
-            .count(),
-        40
-    );
-    assert_eq!(
-        project
-            .elements
-            .values()
-            .filter(|e| e.kind() == Kind::ExchangeCategory)
-            .count(),
-        5
-    );
-    assert_eq!(
-        project
-            .elements
-            .values()
-            .filter(|e| e.kind() == Kind::Process)
-            .count(),
-        3
-    );
-    let view = &project.diagrams[&identity(&project, "forty_exchange_view")];
-    assert_eq!(view.projection, ProjectionKind::FunctionalDataflow);
-    assert_eq!(view.nodes.len(), 2);
-    assert!(view.routes.is_empty());
-    assert_eq!(
-        view.view_options.relation_kinds,
-        view_options::RelationKinds::All
-    );
-    assert_fidelity("dense40-source6", &project);
-}
-
-#[test]
-fn component_ports_interface_operations_and_boundary_calls_roundtrip() {
-    let project = read(OPERATIONS);
-    assert_eq!(
-        project
-            .relations
-            .values()
-            .filter(|r| r.kind() == RelationKind::InterfaceItemAllocation)
-            .count(),
-        2
-    );
-    assert_eq!(
-        project
-            .elements
-            .values()
-            .filter(|e| matches!(
-                e.shared(),
-                Some(SharedBody::Port {
-                    contract: PortContract::Component {
-                        kind: ComponentPortKind::Standard,
-                        ..
-                    },
-                    ..
-                })
-            ))
-            .count(),
-        2
-    );
-    assert!(project.elements.values().any(|e| matches!(
-        e.shared(),
-        Some(SharedBody::ExchangeItem {
-            mechanism: ExchangeMechanism::Operation,
-            ..
-        })
-    )));
-    assert!(project.elements.values().any(|e| matches!(e.shared(), Some(SharedBody::Scenario { viewpoint: ScenarioViewpoint::BoundaryInterface, steps, .. }) if steps.len() == 2)));
-    assert_eq!(
-        project
-            .elements
-            .values()
-            .filter(|e| matches!(
-                e.shared(),
-                Some(SharedBody::Occurrence {
-                    body: OccurrenceBody::Exchange {
-                        message_kind: MessageKind::Call,
-                        operation: None,
-                        ..
-                    },
-                    ..
-                })
-            ))
-            .count(),
-        2
-    );
-    assert_fidelity("boundary-operations-source6", &project);
-}
-
-#[test]
-fn negative_zero_node_coordinate_survives_canonical_compact_and_bundle_compile() {
-    let mut project = read(STATES);
-    let diagram = identity(&project, "state_view");
-    let node = identity(&project, "view_machine");
-    project
-        .diagrams
-        .get_mut(&diagram)
-        .unwrap()
-        .nodes
-        .get_mut(&node)
-        .unwrap()
-        .position = Position { x: -0.0, y: 0.0 };
-    let (decoded, flat) = assert_fidelity("state-negative-zero", &project);
-    let bundle = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), flat)]),
-    };
-    let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
-    let modular = compile_bundle(&format_bundle(&project), ProjectLimits::default()).unwrap();
-    // Project/Position PartialEq alone equates the signs of zero. Check bits in
-    // each independently decoded representation, including source-project compile.
-    for actual in [
-        &decoded,
-        &compiled.decoded.project,
-        &modular.decoded.project,
-    ] {
-        let position = &actual.diagrams[&diagram].nodes[&node].position;
-        assert_eq!(position.x.to_bits(), (-0.0_f32).to_bits());
-        assert_eq!(position.y.to_bits(), 0.0_f32.to_bits());
-    }
-}
-
-#[test]
-fn present_empty_field_default_and_unbounded_maximum_remain_distinct_from_omission() {
-    let mut project = read(KEYED);
-    let field_id = identity(&project, "oa_navigation_latitude");
-    let Some(SharedBody::DataField {
-        minimum,
-        maximum,
-        default,
-        storage,
-        ..
-    }) = project.elements.get_mut(&field_id).unwrap().shared_mut()
-    else {
-        panic!("fixture must contain the claimed DataField");
-    };
-    assert_eq!(*minimum, 0);
-    assert_eq!(*maximum, Some(1));
-    assert_eq!(*default, None);
-    assert_eq!(*storage, FieldStorage::Value);
-    *maximum = None;
-    *default = Some(vec![]);
-    let (decoded, _) = assert_fidelity("keyed-present-empty-default", &project);
-    assert!(
-        matches!(decoded.elements[&field_id].shared(), Some(SharedBody::DataField { maximum: None, default: Some(values), .. }) if values.is_empty())
-    );
-}
-
-#[test]
-fn present_empty_artifact_revision_and_fragment_survive() {
-    let mut project = read(COASTAL);
-    let artifact_id = identity(&project, "console_enclosure_cad");
-    let artifact = project.artifact_links.get_mut(&artifact_id).unwrap();
-    artifact.revision = Some(String::new());
-    artifact.fragment = Some(String::new());
-    let (decoded, _) = assert_fidelity("coastal-present-empty-artifact-strings", &project);
-    assert_eq!(
-        decoded.artifact_links[&artifact_id].revision.as_deref(),
-        Some("")
-    );
-    assert_eq!(
-        decoded.artifact_links[&artifact_id].fragment.as_deref(),
-        Some("")
-    );
-}
-
-#[test]
-fn selected_and_unresolved_operation_intent_survive_as_distinct_present_records() {
-    let mut project = read(OPERATIONS);
-    let allocation = identity(&project, "operation_probe_30");
-    assert_eq!(
-        project.relations[&allocation].kind(),
-        RelationKind::InterfaceItemAllocation
-    );
-    let selected = identity(&project, "operation_probe_43");
-    let unresolved = identity(&project, "operation_probe_44");
-    for (subject, value) in [(selected, Some(allocation)), (unresolved, None)] {
-        let Some(SharedBody::Occurrence {
-            body: OccurrenceBody::Exchange { operation, .. },
-            ..
-        }) = project.elements.get_mut(&subject).unwrap().shared_mut()
-        else {
-            panic!("fixture must contain a Call Exchange");
-        };
-        assert_eq!(*operation, None);
-        *operation = Some(OperationUse { allocation: value });
-    }
-    let (decoded, _) = assert_fidelity("boundary-selected-and-unresolved-operations", &project);
-    assert!(
-        matches!(decoded.elements[&selected].shared(), Some(SharedBody::Occurrence { body: OccurrenceBody::Exchange { operation: Some(OperationUse { allocation: Some(actual) }), .. }, .. }) if *actual == allocation)
-    );
-    assert!(matches!(
-        decoded.elements[&unresolved].shared(),
-        Some(SharedBody::Occurrence {
-            body: OccurrenceBody::Exchange {
-                operation: Some(OperationUse { allocation: None }),
-                ..
-            },
-            ..
-        })
-    ));
-}

crates/oa-core/tests/default_omission_output.rs

@@ -1,256 +0,0 @@
-//! Focused public-output contracts. Field locations come from the real compiler;
-//! token comparisons ignore layout while retaining typed tags and required syntax.
-use oa_core::{language, source_project::*, *};
-use std::collections::BTreeMap;
-
-fn project(declarations: &str) -> Project {
-    language::parse(&format!(
-        "arcadia 7; project p \"P\" id \"00000000-0000-4000-8000-000000000001\" {{ {declarations} }}"
-    )).unwrap()
-}
-
-fn exports(project: &Project) -> Vec<CompiledSourceProject> {
-    let flat = language::format(project);
-    assert_eq!(language::parse(&flat).unwrap(), *project);
-    let flat_bundle = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), flat)]),
-    };
-    [flat_bundle, format_bundle(project)]
-        .into_iter()
-        .map(|bundle| {
-            let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
-            assert_eq!(compiled.decoded.project, *project);
-            assert_eq!(
-                compiled.bundle, bundle,
-                "all identities are explicit and stable"
-            );
-            compiled
-        })
-        .collect()
-}
-
-fn identity(project: &Project, alias: &str) -> Id {
-    project
-        .identities()
-        .into_iter()
-        .find(|(_, name)| *name == alias)
-        .unwrap()
-        .0
-}
-
-fn field(compiled: &CompiledSourceProject, alias: &str, name: &str) -> Option<String> {
-    let location = compiled
-        .index
-        .fields
-        .get(&(identity(&compiled.decoded.project, alias), name.into()))?;
-    let text = &compiled.bundle.files[&location.path][location.span.start..location.span.end];
-    Some(
-        language::tokenize(text)
-            .into_iter()
-            .filter(|token| {
-                !matches!(
-                    token.class,
-                    language::TokenClass::Whitespace | language::TokenClass::Comment
-                )
-            })
-            .map(|token| &text[token.span.start..token.span.end])
-            .collect::<Vec<_>>()
-            .join(" "),
-    )
-}
-
-#[test]
-fn empty_project_has_no_synthetic_description_or_module() {
-    let empty = project("");
-    for compiled in exports(&empty) {
-        assert!(compiled.index.project_description.is_none());
-        assert!(compiled.index.fields.is_empty());
-        assert!(compiled.index.includes.is_empty());
-        assert_eq!(compiled.bundle.files.len(), 1);
-        assert_eq!(compiled.index.declarations.len(), 1);
-    }
-}
-
-#[test]
-fn only_empty_descriptions_disappear_whitespace_and_text_survive_exactly() {
-    let mut model =
-        project("oa_activity work \"Work\" id \"00000000-0000-4000-8000-000000000002\" {}");
-    let work = identity(&model, "work");
-    for description in ["", " \t\n", "A quoted \"requirement\" — 雨"] {
-        model.description = description.into();
-        model.elements.get_mut(&work).unwrap().description = description.into();
-        for compiled in exports(&model) {
-            assert_eq!(
-                compiled.index.project_description.is_some(),
-                !description.is_empty()
-            );
-            assert_eq!(
-                field(&compiled, "work", "description").is_some(),
-                !description.is_empty()
-            );
-            assert!(field(&compiled, "work", "parent").is_none());
-            // exports compares the complete model, including exact whitespace
-            // and escapes in both project and element descriptions.
-        }
-    }
-}
-
-#[test]
-fn sa_view_keeps_its_layer_and_node_references_but_omits_presentation_defaults() {
-    let model = project(
-        r#"
-        sa_function work "Work" id "00000000-0000-4000-8000-000000000002" {}
-        diagram view "View" id "00000000-0000-4000-8000-000000000003" { layer Sa; }
-        node placement id "00000000-0000-4000-8000-000000000004" {
-            diagram @view; element @work;
-            position { x 0.0; y 0.0; }; size { width 224.0; height 94.0; };
-            collapsed false; port_anchors [];
-        }
-    "#,
-    );
-    for compiled in exports(&model) {
-        assert_eq!(field(&compiled, "view", "layer").as_deref(), Some("Sa"));
-        for name in ["description", "projection", "routes", "view_options"] {
-            assert!(field(&compiled, "view", name).is_none(), "view.{name}");
-        }
-        assert_eq!(
-            field(&compiled, "placement", "diagram").as_deref(),
-            Some("@ view")
-        );
-        assert_eq!(
-            field(&compiled, "placement", "element").as_deref(),
-            Some("@ work")
-        );
-        for name in ["position", "size", "collapsed", "port_anchors"] {
-            assert!(
-                field(&compiled, "placement", name).is_none(),
-                "placement.{name}"
-            );
-        }
-    }
-}
-
-#[test]
-fn nested_type_defaults_disappear_without_losing_required_or_present_empty_values() {
-    let model = project(
-        r#"
-        sa_data_type implicit "Implicit" id "00000000-0000-4000-8000-000000000002" {}
-        sa_data_type integer "Integer" id "00000000-0000-4000-8000-000000000003" {
-            definition { Integer { minimum none; maximum none; }; };
-        }
-        sa_data_type text "Text" id "00000000-0000-4000-8000-000000000004" {
-            definition { String { minimum_length 4; maximum_length none; }; };
-        }
-        sa_data_type record "Record" id "00000000-0000-4000-8000-000000000005" {
-            definition { Record { supertype none; }; };
-        }
-        sa_data_type flag "Flag" id "00000000-0000-4000-8000-000000000006" {
-            definition Boolean; default { Boolean false; };
-        }
-        sa_data_field optional "Optional" id "00000000-0000-4000-8000-000000000007" {
-            parent @record; minimum 0; maximum none; default [];
-        }
-    "#,
-    );
-    for compiled in exports(&model) {
-        assert!(field(&compiled, "implicit", "definition").is_none());
-        assert_eq!(
-            field(&compiled, "integer", "definition").as_deref(),
-            Some("{ Integer { } ; }")
-        );
-        assert_eq!(
-            field(&compiled, "text", "definition").as_deref(),
-            Some("{ String { minimum_length 4 ; } ; }")
-        );
-        assert_eq!(
-            field(&compiled, "record", "definition").as_deref(),
-            Some("{ Record { } ; }")
-        );
-        assert_eq!(
-            field(&compiled, "flag", "definition").as_deref(),
-            Some("Boolean")
-        );
-        assert_eq!(
-            field(&compiled, "flag", "default").as_deref(),
-            Some("{ Boolean false ; }")
-        );
-        assert_eq!(
-            field(&compiled, "optional", "minimum").as_deref(),
-            Some("0")
-        );
-        assert_eq!(
-            field(&compiled, "optional", "maximum").as_deref(),
-            Some("none")
-        );
-        assert_eq!(
-            field(&compiled, "optional", "default").as_deref(),
-            Some("[ ]")
-        );
-        assert!(field(&compiled, "optional", "type_ref").is_none());
-    }
-}
-
-#[test]
-fn required_port_contract_and_empty_item_list_survive_while_optional_interface_disappears() {
-    let model = project(
-        r#"
-        sa_function work "Work" id "00000000-0000-4000-8000-000000000002" {}
-        sa_port sink "Sink" id "00000000-0000-4000-8000-000000000003" {
-            parent @work; contract { FunctionInput { incoming_items []; }; };
-        }
-        sa_system host "Host" id "00000000-0000-4000-8000-000000000004" {}
-        sa_port preserved "Preserved" id "00000000-0000-4000-8000-000000000005" {
-            parent @host; contract Legacy; legacy { direction Out; interface none; };
-        }
-    "#,
-    );
-    for compiled in exports(&model) {
-        assert_eq!(
-            field(&compiled, "sink", "contract").as_deref(),
-            Some("{ FunctionInput { incoming_items [ ] ; } ; }")
-        );
-        assert!(field(&compiled, "sink", "legacy").is_none());
-        assert_eq!(
-            field(&compiled, "preserved", "contract").as_deref(),
-            Some("Legacy")
-        );
-        assert_eq!(
-            field(&compiled, "preserved", "legacy").as_deref(),
-            Some("{ direction Out ; }")
-        );
-    }
-}
-
-#[test]
-fn source_scenario_default_and_selected_occurrence_constructor_remain_distinct() {
-    let model = project(
-        r#"
-        sa_scenario mixed "Mixed" id "00000000-0000-4000-8000-000000000002" { viewpoint MixedLegacy; }
-        sa_scenario strict "Strict" id "00000000-0000-4000-8000-000000000003" { viewpoint Functional; }
-        oa_process flow "Flow" id "00000000-0000-4000-8000-000000000004" { steps [@exchange, @action]; }
-        oa_occurrence exchange "Exchange" id "00000000-0000-4000-8000-000000000005" {
-            parent @flow; body { Exchange {}; };
-        }
-        oa_occurrence action "Action" id "00000000-0000-4000-8000-000000000006" {
-            parent @flow; body { Action { action none; lifeline none; }; };
-        }
-    "#,
-    );
-    for compiled in exports(&model) {
-        assert!(field(&compiled, "mixed", "viewpoint").is_none());
-        assert_eq!(
-            field(&compiled, "strict", "viewpoint").as_deref(),
-            Some("Functional")
-        );
-        assert!(field(&compiled, "exchange", "body").is_none());
-        assert_eq!(
-            field(&compiled, "action", "body").as_deref(),
-            Some("{ Action { } ; }")
-        );
-        assert_eq!(
-            field(&compiled, "action", "parent").as_deref(),
-            Some("@ flow")
-        );
-    }
-}

crates/oa-core/tests/default_omission_preservation.rs

@@ -1,612 +0,0 @@
-//! Exact-source regressions for fields skipped by persistence serialization.
-//!
-//! The archived Windows baseline confirmed three exact-source failures after
-//! full model equality passed. Complete comparison now preserves these fields;
-//! the former ignored witnesses are normal regression tests.
-//! No-op and same-record header controls remain normal tests: they must preserve
-//! the same fixtures without entering the changed-payload record-erasure branch.
-
-use oa_core::{source_project::*, *};
-use std::collections::BTreeMap;
-
-const EXCHANGE_SOURCE: &str = r#"arcadia 7;
-project p "Preservation" id "00000000-0000-4000-8000-000000000001" {
-    oa_activity first "First" id "00000000-0000-4000-8000-000000000002" {}
-    oa_activity second "Second" id "00000000-0000-4000-8000-000000000003" {}
-    interaction flow "Flow" id "00000000-0000-4000-8000-000000000004" {
-        source @first; target @second;
-    }
-    oa_process owner "Owner" id "00000000-0000-4000-8000-000000000005" {
-        steps [@subject];
-    }
-    oa_occurrence subject "Subject" id "00000000-0000-4000-8000-000000000006" {
-        parent @owner;
-        body { Exchange {
-            exchange none;
-            sender none; receiver none;
-            message_kind Asynchronous; reply_to none; values [];
-            operation   none ; // Keep this authored default and its spelling.
-        }; };
-    }
-}
-"#;
-
-const NODE_SOURCE: &str = r#"arcadia 7;
-project p "Preservation" id "00000000-0000-4000-8000-000000000001" {
-    oa_activity work "Work" id "00000000-0000-4000-8000-000000000002" {}
-    diagram view "View" id "00000000-0000-4000-8000-000000000003" {}
-    node placement id "00000000-0000-4000-8000-000000000004" {
-        diagram @view; element @work;
-        position { x 12.5; y -4.0; };
-        port_anchors   [] ; // Keep explicit automatic placement.
-    }
-}
-"#;
-
-const TRACE_SOURCE: &str = r#"arcadia 7;
-project p "Preservation" id "00000000-0000-4000-8000-000000000001" {
-    oa_activity work "Work" id "00000000-0000-4000-8000-000000000002" {}
-    sa_function function "Function" id "00000000-0000-4000-8000-000000000003" {}
-    trace mapping "Mapping" id "00000000-0000-4000-8000-000000000004" {
-        oa @work; sa @function; kind Manual;
-        baseline {
-            oa { name "Work"; description "Old OA snapshot"; };
-            sa { name "Function"; description "Old SA snapshot"; };
-            semantic   none ; // Keep the explicit prose-only baseline.
-        };
-    }
-}
-"#;
-
-const CONSTRUCTOR_SOURCE: &str = r#"arcadia 7;
-project p "Preservation" id "00000000-0000-4000-8000-000000000001" {
-    oa_scenario owner "Owner" id "00000000-0000-4000-8000-000000000002" {
-        steps [@subject];
-    }
-    oa_occurrence subject "Subject" id "00000000-0000-4000-8000-000000000003" {
-        parent @owner;
-        body { Action {
-            action none;
-            lifeline   none ; // Keep this shared field's distinctive spelling.
-        }; };
-    }
-}
-"#;
-
-const RELATION_CONTEXT_SOURCE: &str = r#"arcadia 7;
-project p "Preservation" id "00000000-0000-4000-8000-000000000001" {
-    oa_entity first "First" id "00000000-0000-4000-8000-000000000002" {}
-    oa_entity second "Second" id "00000000-0000-4000-8000-000000000003" {}
-    // These port declarations are untouched by the relation context change.
-    oa_port output "Output" id "00000000-0000-4000-8000-000000000005" {
-        parent @first; contract Legacy;
-        legacy { direction Out; interface none; };
-    }
-    oa_port input "Input" id "00000000-0000-4000-8000-000000000006" {
-        parent @second; contract Legacy;
-        legacy { direction In; interface none; };
-    }
-    boundary_exchange link "Link" id "00000000-0000-4000-8000-000000000004" {
-        source @output; target @input;
-        oriented   true ; // Retain this rationale when changing the default value.
-        items [];
-    }
-}
-"#;
-
-fn id(number: u8) -> Id {
-    Id::parse_str(&format!("00000000-0000-4000-8000-{number:012}")).unwrap()
-}
-
-fn source_bundle(source: &str) -> SourceBundle {
-    SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), source.into())]),
-    }
-}
-
-fn project() -> Project {
-    Project {
-        schema_version: 7,
-        id: id(1),
-        alias: "p".into(),
-        name: "Preservation".into(),
-        description: String::new(),
-        elements: BTreeMap::new(),
-        relations: BTreeMap::new(),
-        diagrams: BTreeMap::new(),
-        artifact_links: BTreeMap::new(),
-        traces: BTreeMap::new(),
-    }
-}
-
-fn element(number: u8, alias: &str, name: &str, parent: Option<Id>, body: ElementBody) -> Element {
-    Element {
-        id: id(number),
-        alias: alias.into(),
-        name: name.into(),
-        description: String::new(),
-        parent,
-        body,
-    }
-}
-
-// Handwritten typed expectations are independent of canonical serialization and
-// source hydration. No model factories or generated/random identities are used.
-fn exchange_project() -> Project {
-    let mut expected = project();
-    expected.elements = [
-        element(2, "first", "First", None, ElementBody::Oa(OaBody::Activity)),
-        element(
-            3,
-            "second",
-            "Second",
-            None,
-            ElementBody::Oa(OaBody::Activity),
-        ),
-        element(
-            5,
-            "owner",
-            "Owner",
-            None,
-            ElementBody::Oa(OaBody::Process { steps: vec![id(6)] }),
-        ),
-        element(
-            6,
-            "subject",
-            "Subject",
-            Some(id(5)),
-            ElementBody::Oa(OaBody::Shared(SharedBody::Occurrence {
-                body: OccurrenceBody::Exchange {
-                    exchange: None,
-                    sender: None,
-                    receiver: None,
-                    message_kind: MessageKind::Asynchronous,
-                    reply_to: None,
-                    values: vec![],
-                    operation: None,
-                },
-                precondition: String::new(),
-                postcondition: String::new(),
-            })),
-        ),
-    ]
-    .into_iter()
-    .map(|element| (element.id, element))
-    .collect();
-    expected.relations.insert(
-        id(4),
-        Relation {
-            id: id(4),
-            alias: "flow".into(),
-            name: "Flow".into(),
-            description: String::new(),
-            body: RelationBody::Interaction {
-                source: id(2),
-                target: id(3),
-                items: vec![],
-            },
-        },
-    );
-    expected
-}
-
-fn node_project() -> Project {
-    let mut expected = project();
-    expected.elements.insert(
-        id(2),
-        element(2, "work", "Work", None, ElementBody::Oa(OaBody::Activity)),
-    );
-    expected.diagrams.insert(
-        id(3),
-        Diagram {
-            id: id(3),
-            alias: "view".into(),
-            name: "View".into(),
-            description: String::new(),
-            layer: Layer::Oa,
-            projection: ProjectionKind::Overview,
-            view_options: view_options::ViewOptions {
-                hidden_edges: vec![],
-                relation_kinds: view_options::RelationKinds::All,
-                work_categories: view_options::CategorySelection::All,
-                participant_categories: view_options::CategorySelection::All,
-                coverage: view_options::Coverage::All,
-                work_contexts: view_options::ContextSelection::All,
-                exchange_labels: view_options::ExchangeLabels::Name,
-            },
-            nodes: BTreeMap::from([(
-                id(4),
-                NodePlacement {
-                    id: id(4),
-                    alias: "placement".into(),
-                    element: id(2),
-                    position: Position { x: 12.5, y: -4.0 },
-                    size: Size {
-                        width: 224.0,
-                        height: 94.0,
-                    },
-                    collapsed: false,
-                    port_anchors: vec![],
-                },
-            )]),
-            routes: vec![],
-        },
-    );
-    expected
-}
-
-fn trace_project() -> Project {
-    let mut expected = project();
-    expected.elements = [
-        element(2, "work", "Work", None, ElementBody::Oa(OaBody::Activity)),
-        element(
-            3,
-            "function",
-            "Function",
-            None,
-            ElementBody::Sa(SaBody::Function),
-        ),
-    ]
-    .into_iter()
-    .map(|element| (element.id, element))
-    .collect();
-    expected.traces.insert(
-        id(4),
-        Trace {
-            id: id(4),
-            alias: "mapping".into(),
-            name: "Mapping".into(),
-            description: String::new(),
-            oa: id(2),
-            sa: id(3),
-            kind: TraceKind::Manual,
-            baseline: Some(TraceBaseline {
-                oa: TracedProperties {
-                    name: "Work".into(),
-                    description: "Old OA snapshot".into(),
-                },
-                sa: TracedProperties {
-                    name: "Function".into(),
-                    description: "Old SA snapshot".into(),
-                },
-                semantic: None,
-            }),
-        },
-    );
-    expected
-}
-
-fn checked_fixture(source: &str, expected: &Project) -> CompiledSourceProject {
-    let input = source_bundle(source);
-    let compiled = compile_bundle(&input, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        compiled.decoded.project, *expected,
-        "fixture model admission"
-    );
-    assert_eq!(
-        compiled.bundle, input,
-        "fixed IDs must avoid stabilization edits"
-    );
-    compiled
-}
-
-fn replacement(source: &str, before: &str, after: &str) -> String {
-    assert_eq!(
-        source.matches(before).count(),
-        1,
-        "unique authored edit token"
-    );
-    source.replacen(before, after, 1)
-}
-
-fn assert_preserved_update(
-    original: &CompiledSourceProject,
-    expected: &Project,
-    expected_source: &str,
-) {
-    // Independently admit the exact expected spelling before testing the updater.
-    let expected_bundle = source_bundle(expected_source);
-    let authored = compile_bundle(&expected_bundle, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        authored.decoded.project, *expected,
-        "expected source/model agree"
-    );
-    assert_eq!(
-        authored.bundle, expected_bundle,
-        "expected source is already stable"
-    );
-
-    let updated = update_bundle(original, expected, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        updated.decoded.project, *expected,
-        "entire intended model survives"
-    );
-    assert_eq!(
-        updated.bundle, expected_bundle,
-        "only the requested token may change; preserve explicit defaults and all trivia"
-    );
-}
-
-// Context changes may introduce/remove redundant default syntax. Admit each
-// narrowly enumerated spelling against the same literal target model, and then
-// compare complete source bundles. No normalization may mask edits to unrelated
-// fields, declarations, whitespace, or comments.
-fn assert_context_update(
-    original: &CompiledSourceProject,
-    expected: &Project,
-    allowed_sources: &[String],
-) {
-    let allowed: Vec<_> = allowed_sources
-        .iter()
-        .map(|source| {
-            let bundle = source_bundle(source);
-            let authored = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
-            assert_eq!(
-                authored.decoded.project, *expected,
-                "allowed source/model agree"
-            );
-            assert_eq!(authored.bundle, bundle, "allowed source is already stable");
-            bundle
-        })
-        .collect();
-    let updated = update_bundle(original, expected, ProjectLimits::default()).unwrap();
-    assert_eq!(
-        updated.decoded.project, *expected,
-        "entire context-change model survives"
-    );
-    assert!(
-        allowed.contains(&updated.bundle),
-        "preserve unchanged source exactly; only listed changed/default syntax alternatives are allowed\nactual: {:?}\nallowed: {:?}",
-        updated.bundle,
-        allowed
-    );
-}
-
-#[test]
-fn explicit_exchange_operation_none_survives_noop() {
-    let expected = exchange_project();
-    let original = checked_fixture(EXCHANGE_SOURCE, &expected);
-    assert_preserved_update(&original, &expected, EXCHANGE_SOURCE);
-}
-
-#[test]
-fn explicit_exchange_operation_none_survives_header_rename() {
-    let mut expected = exchange_project();
-    let original = checked_fixture(EXCHANGE_SOURCE, &expected);
-    expected.elements.get_mut(&id(6)).unwrap().name = "Renamed subject".into();
-    let source = replacement(EXCHANGE_SOURCE, "\"Subject\"", "\"Renamed subject\"");
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn explicit_exchange_operation_none_survives_exchange_binding_edit() {
-    let mut expected = exchange_project();
-    let original = checked_fixture(EXCHANGE_SOURCE, &expected);
-    let Some(SharedBody::Occurrence {
-        body: OccurrenceBody::Exchange { exchange, .. },
-        ..
-    }) = expected.elements.get_mut(&id(6)).unwrap().body.shared_mut()
-    else {
-        panic!("literal fixture must be an Exchange occurrence");
-    };
-    *exchange = Some(id(4));
-    let source = replacement(EXCHANGE_SOURCE, "exchange none;", "exchange @flow;");
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn explicit_node_empty_port_anchors_survive_noop() {
-    let expected = node_project();
-    let original = checked_fixture(NODE_SOURCE, &expected);
-    assert_preserved_update(&original, &expected, NODE_SOURCE);
-}
-
-#[test]
-fn explicit_node_empty_port_anchors_survive_header_alias_rename() {
-    let mut expected = node_project();
-    let original = checked_fixture(NODE_SOURCE, &expected);
-    // Nodes have no display-name header. Rename the same node's header alias.
-    expected
-        .diagrams
-        .get_mut(&id(3))
-        .unwrap()
-        .nodes
-        .get_mut(&id(4))
-        .unwrap()
-        .alias = "renamed_placement".into();
-    let source = replacement(
-        NODE_SOURCE,
-        "node placement id",
-        "node renamed_placement id",
-    );
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn explicit_node_empty_port_anchors_survive_position_edit() {
-    let mut expected = node_project();
-    let original = checked_fixture(NODE_SOURCE, &expected);
-    expected
-        .diagrams
-        .get_mut(&id(3))
-        .unwrap()
-        .nodes
-        .get_mut(&id(4))
-        .unwrap()
-        .position
-        .x = 25.0;
-    let source = replacement(NODE_SOURCE, "x 12.5;", "x 25.0;");
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn explicit_trace_semantic_none_survives_noop() {
-    let expected = trace_project();
-    let original = checked_fixture(TRACE_SOURCE, &expected);
-    assert_preserved_update(&original, &expected, TRACE_SOURCE);
-}
-
-#[test]
-fn explicit_trace_semantic_none_survives_header_rename() {
-    let mut expected = trace_project();
-    let original = checked_fixture(TRACE_SOURCE, &expected);
-    expected.traces.get_mut(&id(4)).unwrap().name = "Renamed mapping".into();
-    let source = replacement(TRACE_SOURCE, "\"Mapping\"", "\"Renamed mapping\"");
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn explicit_trace_semantic_none_survives_snapshot_prose_edit() {
-    let mut expected = trace_project();
-    let original = checked_fixture(TRACE_SOURCE, &expected);
-    expected
-        .traces
-        .get_mut(&id(4))
-        .unwrap()
-        .baseline
-        .as_mut()
-        .unwrap()
-        .oa
-        .description = "Revised OA snapshot".into();
-    let source = replacement(
-        TRACE_SOURCE,
-        "\"Old OA snapshot\"",
-        "\"Revised OA snapshot\"",
-    );
-    assert_preserved_update(&original, &expected, &source);
-}
-
-#[test]
-fn constructor_change_removes_inapplicable_default_and_keeps_shared_default() {
-    let mut expected = project();
-    expected.elements = [
-        element(
-            2,
-            "owner",
-            "Owner",
-            None,
-            ElementBody::Oa(OaBody::Shared(SharedBody::Scenario {
-                viewpoint: ScenarioViewpoint::MixedLegacy,
-                context: None,
-                precondition: String::new(),
-                postcondition: String::new(),
-                steps: vec![id(3)],
-            })),
-        ),
-        element(
-            3,
-            "subject",
-            "Subject",
-            Some(id(2)),
-            ElementBody::Oa(OaBody::Shared(SharedBody::Occurrence {
-                body: OccurrenceBody::Action {
-                    action: None,
-                    lifeline: None,
-                },
-                precondition: String::new(),
-                postcondition: String::new(),
-            })),
-        ),
-    ]
-    .into_iter()
-    .map(|element| (element.id, element))
-    .collect();
-    let original = checked_fixture(CONSTRUCTOR_SOURCE, &expected);
-    expected.elements.get_mut(&id(3)).unwrap().body =
-        ElementBody::Oa(OaBody::Shared(SharedBody::Occurrence {
-            body: OccurrenceBody::State {
-                state: None,
-                lifeline: None,
-            },
-            precondition: String::new(),
-            postcondition: String::new(),
-        }));
-    // Remove only the inapplicable field's syntax: its separating space and all
-    // surrounding trivia stay. The shared lifeline spelling/comment is exact.
-    let source = replacement(CONSTRUCTOR_SOURCE, "body { Action {", "body { State {");
-    let compact = replacement(&source, "action none;", " ");
-    let expanded = replacement(
-        &compact,
-        "        }; };",
-        "            state none;\n        }; };",
-    );
-    // Omission of newly applicable state and explicit state none both mean the
-    // literal State target; neither may retain the old action field.
-    assert_context_update(&original, &expected, &[compact, expanded]);
-}
-
-#[test]
-fn relation_kind_change_updates_explicit_value_when_context_default_changes() {
-    let mut expected = project();
-    expected.elements = [
-        element(2, "first", "First", None, ElementBody::Oa(OaBody::Entity)),
-        element(3, "second", "Second", None, ElementBody::Oa(OaBody::Entity)),
-        element(
-            5,
-            "output",
-            "Output",
-            Some(id(2)),
-            ElementBody::Oa(OaBody::Shared(SharedBody::Port {
-                contract: PortContract::Legacy,
-                legacy: Some(LegacyPortContract {
-                    direction: PortDirection::Out,
-                    interface: None,
-                }),
-            })),
-        ),
-        element(
-            6,
-            "input",
-            "Input",
-            Some(id(3)),
-            ElementBody::Oa(OaBody::Shared(SharedBody::Port {
-                contract: PortContract::Legacy,
-                legacy: Some(LegacyPortContract {
-                    direction: PortDirection::In,
-                    interface: None,
-                }),
-            })),
-        ),
-    ]
-    .into_iter()
-    .map(|element| (element.id, element))
-    .collect();
-    expected.relations.insert(
-        id(4),
-        Relation {
-            id: id(4),
-            alias: "link".into(),
-            name: "Link".into(),
-            description: String::new(),
-            body: RelationBody::BoundaryExchange {
-                source: id(5),
-                target: id(6),
-                oriented: true,
-                items: vec![],
-            },
-        },
-    );
-    let original = checked_fixture(RELATION_CONTEXT_SOURCE, &expected);
-    // BoundaryExchange connects participant ports; CommunicationMean connects
-    // their OA entity owners. Endpoint changes are explicit parts of this target,
-    // not inferred or normalized away. Port records remain exactly unchanged.
-    expected.relations.get_mut(&id(4)).unwrap().body = RelationBody::CommunicationMean {
-        source: id(2),
-        target: id(3),
-        oriented: false,
-        items: vec![],
-    };
-    let source = replacement(
-        RELATION_CONTEXT_SOURCE,
-        "boundary_exchange link",
-        "communication_mean link",
-    );
-    let source = replacement(&source, "source @output;", "source @first;");
-    let source = replacement(&source, "target @input;", "target @second;");
-    let explicit = replacement(&source, "oriented   true ;", "oriented   false ;");
-    // Three spaces between name/value plus one before the semicolon survive
-    // syntax removal. The following rationale comment and all other bytes stay.
-    let omitted = replacement(&source, "oriented   true ;", "    ");
-    assert_context_update(&original, &expected, &[explicit, omitted]);
-}

crates/oa-core/tests/default_omission_updates.rs

@@ -1,222 +0,0 @@
-//! Public update witnesses for compact insertion and complete comparison.
-use oa_core::{language, source_project::*, *};
-use std::collections::BTreeMap;
-
-fn compile(body: &str) -> CompiledSourceProject {
-    compile_bundle(
-        &SourceBundle {
-            entry: "project.arcadia".into(),
-            files: BTreeMap::from([
-                (
-                    "project.arcadia".into(),
-                    "arcadia 7; project p \"P\" { include \"model.arcadia\"; }".into(),
-                ),
-                ("model.arcadia".into(), body.into()),
-            ]),
-        },
-        ProjectLimits::default(),
-    )
-    .unwrap()
-}
-fn id(project: &Project, alias: &str) -> Id {
-    project
-        .identities()
-        .into_iter()
-        .find(|(_, a)| *a == alias)
-        .unwrap()
-        .0
-}
-fn update(before: &CompiledSourceProject, project: &Project) -> CompiledSourceProject {
-    let result = update_bundle(before, project, ProjectLimits::default()).unwrap();
-    assert_eq!(result.decoded.project, *project);
-    assert_eq!(
-        result.bundle.files["project.arcadia"],
-        before.bundle.files["project.arcadia"]
-    );
-    assert_eq!(
-        compile_bundle(&result.bundle, ProjectLimits::default())
-            .unwrap()
-            .bundle,
-        result.bundle
-    );
-    assert_eq!(
-        update_bundle(&result, project, ProjectLimits::default())
-            .unwrap()
-            .bundle,
-        result.bundle
-    );
-    result
-}
-fn words(text: &str) -> Vec<&str> {
-    language::tokenize(text)
-        .into_iter()
-        .filter(|t| {
-            !matches!(
-                t.class,
-                language::TokenClass::Whitespace | language::TokenClass::Comment
-            )
-        })
-        .map(|t| &text[t.span.start..t.span.end])
-        .collect()
-}
-
-#[test]
-fn omitted_exchange_body_changes_to_one_compact_action_constructor() {
-    let before = compile(
-        "oa_scenario s \"S\" { steps [@o]; }\noa_occurrence o \"O\" { parent @s; // keep this\n}\n",
-    );
-    let mut project = before.decoded.project.clone();
-    let occurrence = id(&project, "o");
-    let Some(SharedBody::Occurrence { body, .. }) =
-        project.elements.get_mut(&occurrence).unwrap().shared_mut()
-    else {
-        panic!("occurrence")
-    };
-    assert!(matches!(body, OccurrenceBody::Exchange { .. }));
-    *body = OccurrenceBody::Action {
-        action: None,
-        lifeline: None,
-    };
-    let result = update(&before, &project);
-    let text = &result.bundle.files["model.arcadia"];
-    let tokens = words(text);
-    assert_eq!(tokens.iter().filter(|&&t| t == "body").count(), 1);
-    assert!(tokens.contains(&"Action"));
-    for absent in ["Exchange", "action", "lifeline", "operation", "description"] {
-        assert!(!tokens.contains(&absent), "{absent}: {text}");
-    }
-    assert!(text.contains("parent @s; // keep this"));
-}
-
-#[test]
-fn default_signal_constructor_still_inserts_its_required_empty_items() {
-    let before =
-        compile("oa_event e \"E\" { body { Time { expression \"1 s\"; kind After; }; }; }\n");
-    let mut project = before.decoded.project.clone();
-    let event = id(&project, "e");
-    let Some(SharedBody::Event { body }) = project.elements.get_mut(&event).unwrap().shared_mut()
-    else {
-        panic!("event")
-    };
-    *body = EventBody::Signal { items: vec![] };
-    let result = update(&before, &project);
-    let tokens = words(&result.bundle.files["model.arcadia"]);
-    assert!(tokens.contains(&"Signal"));
-    assert!(tokens.windows(4).any(|w| w == ["items", "[", "]", ";"]));
-    assert!(!tokens.contains(&"expression"));
-    assert!(!tokens.contains(&"kind"));
-}
-
-#[test]
-fn scalar_to_default_string_record_retains_required_minimum_only() {
-    let before = compile("oa_data_type t \"T\" { definition Boolean; // typed rationale\n}\n");
-    let mut project = before.decoded.project.clone();
-    let datatype = id(&project, "t");
-    let Some(SharedBody::DataType { definition, .. }) =
-        project.elements.get_mut(&datatype).unwrap().shared_mut()
-    else {
-        panic!("data type")
-    };
-    *definition = DataTypeDefinition::String {
-        minimum_length: 0,
-        maximum_length: None,
-    };
-    let result = update(&before, &project);
-    let text = &result.bundle.files["model.arcadia"];
-    let tokens = words(text);
-    assert!(tokens.contains(&"String"));
-    assert!(tokens.windows(3).any(|w| w == ["minimum_length", "0", ";"]));
-    assert!(!tokens.contains(&"maximum_length"));
-    assert!(text.contains("// typed rationale"));
-}
-
-#[test]
-fn inserted_route_list_item_omits_only_optional_fields() {
-    let before = compile(
-        "oa_activity a \"A\" {}\noa_activity b \"B\" {}\ninteraction flow \"Flow\" { source @a; target @b; }\ndiagram d \"D\" { routes []; // routing rationale\n}\n",
-    );
-    let mut project = before.decoded.project.clone();
-    let diagram = id(&project, "d");
-    let edge = id(&project, "flow");
-    // Deserialize only the explicit witness value, independently of omission policy.
-    project.diagrams.get_mut(&diagram).unwrap().routes =
-        serde_json::from_value(serde_json::json!([{"edge":edge,"waypoints":[],"label":null}]))
-            .unwrap();
-    let result = update(&before, &project);
-    let text = &result.bundle.files["model.arcadia"];
-    let tokens = words(text);
-    assert!(tokens.windows(4).any(|w| w == ["edge", "@", "flow", ";"]));
-    assert!(!tokens.contains(&"waypoints"));
-    assert!(!tokens.contains(&"label"));
-    assert!(text.contains("// routing rationale"));
-}
-
-#[test]
-fn zero_sign_change_inserts_position_without_default_siblings() {
-    let before = compile(
-        "oa_activity a \"A\" {}\ndiagram d \"D\" {}\nnode n { diagram @d; element @a; // placement rationale\n}\n",
-    );
-    let mut project = before.decoded.project.clone();
-    let diagram = id(&project, "d");
-    let node = id(&project, "n");
-    assert_eq!(
-        project.diagrams[&diagram].nodes[&node].position.x.to_bits(),
-        0.0_f32.to_bits()
-    );
-    project
-        .diagrams
-        .get_mut(&diagram)
-        .unwrap()
-        .nodes
-        .get_mut(&node)
-        .unwrap()
-        .position
-        .x = -0.0;
-    let result = update(&before, &project);
-    assert_eq!(
-        result.decoded.project.diagrams[&diagram].nodes[&node]
-            .position
-            .x
-            .to_bits(),
-        (-0.0_f32).to_bits()
-    );
-    let text = &result.bundle.files["model.arcadia"];
-    let tokens = words(text);
-    assert!(tokens.windows(3).any(|w| w == ["x", "-0.0", ";"]));
-    for absent in ["size", "collapsed", "port_anchors"] {
-        assert!(!tokens.contains(&absent));
-    }
-    assert!(text.contains("// placement rationale"));
-}
-
-#[test]
-fn kind_change_materializes_unchanged_value_when_its_old_omission_default_changes() {
-    let before = compile(
-        "oa_entity a \"A\" {}\noa_entity b \"B\" {}\noa_port out \"Out\" { parent @a; contract Legacy; legacy { direction Out; }; }\noa_port input \"In\" { parent @b; contract Legacy; legacy { direction In; }; }\nboundary_exchange flow \"Flow\" { source @out; target @input; // orientation inherited\n}\n",
-    );
-    let mut project = before.decoded.project.clone();
-    let flow = id(&project, "flow");
-    assert!(matches!(
-        project.relations[&flow].body,
-        RelationBody::BoundaryExchange { oriented: true, .. }
-    ));
-    project.relations.get_mut(&flow).unwrap().body = RelationBody::CommunicationMean {
-        source: id(&before.decoded.project, "a"),
-        target: id(&before.decoded.project, "b"),
-        oriented: true,
-        items: vec![],
-    };
-    let result = update(&before, &project);
-    let text = &result.bundle.files["model.arcadia"];
-    assert!(
-        words(text)
-            .windows(3)
-            .any(|w| w == ["oriented", "true", ";"])
-    );
-    assert!(text.contains("// orientation inherited"));
-    let before_ports = &before.bundle.files["model.arcadia"];
-    assert_eq!(
-        text.split("communication_mean").next().unwrap(),
-        before_ports.split("boundary_exchange").next().unwrap()
-    );
-}

crates/oa-core/tests/language.rs

@@ -3,16 +3,6 @@ use oa_core::{language, persistence, validation, *};
 fn read(source: &str) -> Project {
     language::parse(source).unwrap_or_else(|e| panic!("{e:?}\n{source}"))
 }
-fn replace_once(source: &str, before: &str, after: &str) -> String {
-    assert_eq!(
-        source.matches(before).count(),
-        1,
-        "unique mutation anchor {before:?}"
-    );
-    let changed = source.replacen(before, after, 1);
-    assert_ne!(changed, source, "test mutation must change the source");
-    changed
-}
 fn rejected(source: &str, fragment: &str) {
     let errors = language::parse(source).expect_err(source);
     assert!(
@@ -763,8 +753,8 @@ fn typed_events_vertices_and_transition_kinds_round_trip_in_both_layers() {
         source.push('}');
         let model = read(&source);
         let canonical = language::format(&model);
-        assert!(!canonical.contains("transition_kind External;"));
         for fragment in [
+            "transition_kind External;",
             "transition_kind Local;",
             "transition_kind Internal;",
             "triggers [@deadline, @assess];",
@@ -786,7 +776,6 @@ fn typed_events_vertices_and_transition_kinds_round_trip_in_both_layers() {
             .find(|r| r.alias == "recover")
             .unwrap();
         let RelationBody::StateTransition {
-            transition_kind,
             trigger,
             guard,
             effect,
@@ -795,42 +784,32 @@ fn typed_events_vertices_and_transition_kinds_round_trip_in_both_layers() {
         else {
             panic!("expected transition")
         };
-        assert_eq!(*transition_kind, TransitionKind::External);
         assert_eq!(trigger, "Operator confirms\nНе запускать код");
         assert_eq!(guard, "available && status == \"Ready\"");
         assert_eq!(effect, "Record the assessment");
-        // External is omitted in compact output. Insert an explicit invalid
-        // discriminator into Recover using its unique, nondefault trigger list.
-        let invalid_kind = replace_once(
-            &canonical,
-            "triggers [@deadline, @assess];",
-            "transition_kind Unsupported;\n        triggers [@deadline, @assess];",
-        );
-        rejected(&invalid_kind, "Unsupported");
         for invalid in [
-            replace_once(
-                &canonical,
+            canonical.replace("transition_kind External;", "transition_kind Unsupported;"),
+            canonical.replace(
                 "triggers [@deadline, @assess];",
                 "triggers [\"deadline\", @assess];",
             ),
-            replace_once(
-                &canonical,
+            canonical.replace(
                 "triggers [@deadline, @assess];",
                 "triggers [@deadline, @deadline];",
             ),
-            replace_once(&canonical, "effects [@assess];", "effects [@payload];"),
-            replace_once(&canonical, "kind After;", "kind Relative;"),
-            replace_once(&canonical, "items [@payload];", "items [@assess];"),
+            canonical.replace("effects [@assess];", "effects [@payload];"),
+            canonical.replace("kind After;", "kind Relative;"),
+            canonical.replace("items [@payload];", "items [@assess];"),
         ] {
             assert!(
                 language::parse(&invalid).is_err(),
                 "invalid typed state/event source accepted"
             );
         }
-        // Canonical source already omits External. Removing the supplied lists
-        // independently exercises their empty omission defaults and retained prose.
-        let legacy = replace_once(&canonical, "triggers [@deadline, @assess];", "");
-        let legacy = replace_once(&legacy, "effects [@assess];", "");
+        let legacy = canonical
+            .replace("transition_kind External;", "")
+            .replace("triggers [@deadline, @assess];", "")
+            .replace("effects [@assess];", "");
         let legacy = read(&legacy);
         let RelationBody::StateTransition {
             transition_kind,
@@ -850,7 +829,7 @@ fn typed_events_vertices_and_transition_kinds_round_trip_in_both_layers() {
             (retained_trigger, retained_guard, retained_effect),
             (trigger, guard, effect)
         );
-        let draft = replace_once(&canonical, "expression \"30 s\";", "expression \"\";");
+        let draft = canonical.replace("expression \"30 s\";", "expression \"\";");
         assert!(language::parse(&draft).is_ok());
         let deadline = model
             .elements
@@ -1059,7 +1038,7 @@ fn original_v2_text_and_json_preserve_identity_and_mixed_scenarios_after_extensi
         "fixture must cover actual old scenario content"
     );
     let canonical = language::format(&from_source);
-    assert!(!canonical.contains("viewpoint MixedLegacy;"));
+    assert!(canonical.contains("viewpoint MixedLegacy;"));
     for relation in from_source.relations.values() {
         if let RelationBody::StateTransition {
             transition_kind,

crates/oa-core/tests/port_anchors.rs

@@ -767,15 +767,7 @@ fn resetting_last_source_anchors_preserves_comments_and_can_add_a_new_manual_rec
     assert_eq!(cleared.decoded.project, prepared.project);
     let text = &cleared.bundle.files["project.arcadia"];
     assert!(text.contains("// first rationale") && text.contains("// second rationale"));
-    // Lossless editing may retain the authored empty field and its annotations.
-    // Canonical export, rather than a model update, normalizes default syntax.
-    assert!(!language::format(&cleared.decoded.project).contains("port_anchors"));
-    assert_eq!(
-        update_bundle(&cleared, &cleared.decoded.project, ProjectLimits::default())
-            .unwrap()
-            .bundle,
-        cleared.bundle
-    );
+    assert!(!text.contains("port_anchors"));
     let prepared = prepare_command(
         &cleared.decoded.project,
         &Command::SetPortAnchor {

crates/oa-core/tests/source7_contract.rs

@@ -261,7 +261,7 @@ fn source7_context_lifecycle_source_history_and_closed_admission() {
     assert_eq!(session.project(), &after);
     let fresh = Id::new_v4();
     let mut reidentified = after.clone();
-    references::remap_references(&mut reidentified, f.r1, fresh);
+    references::remap_references(&mut reidentified, f.r1, fresh).unwrap();
     let mut e = reidentified.elements.remove(&f.r1).unwrap();
     e.id = fresh;
     reidentified.elements.insert(fresh, e);

crates/oa-core/tests/source_files.rs

@@ -383,87 +383,3 @@ fn atomic_save_preserves_existing_unix_permissions() {
         0o640
     );
 }
-
-#[test]
-fn discovery_diagnostics_keep_raw_no_uuid_spans() {
-    let directory = setup();
-    let path = directory.path().join("parts/a.arcadia");
-    let raw =
-        "// Unicode: 航海\nsa_function first \"First\" {}\nsa_function second \"Second\" {}\n";
-    fs::write(&path, raw).unwrap();
-    let disk = load_project(
-        &directory.path().join("project.arcadia"),
-        ProjectLimits::default(),
-    )
-    .unwrap();
-    assert_eq!(disk.bundle.files["parts/a.arcadia"], raw);
-    let issue = disk
-        .diagnostics
-        .iter()
-        .find(|issue| {
-            issue.diagnostic.code == "unallocated_leaf"
-                && issue.diagnostic.message.contains("Second")
-        })
-        .unwrap();
-    assert_eq!(issue.path, "parts/a.arcadia");
-    assert_eq!(issue.diagnostic.line, 3);
-    assert_eq!(issue.diagnostic.column, 1);
-    let span = issue.diagnostic.span;
-    assert_eq!(span.start, raw.find("sa_function second").unwrap());
-    assert_eq!(
-        &raw[span.start..span.end],
-        "sa_function second \"Second\" {}"
-    );
-    let compiled = compile_bundle(&disk.reachable_bundle(), ProjectLimits::default()).unwrap();
-    assert_ne!(compiled.bundle, disk.bundle);
-    assert!(compiled.diagnostics.iter().any(|later| {
-        later.diagnostic.code == issue.diagnostic.code
-            && later.diagnostic.message == issue.diagnostic.message
-            && later.diagnostic.span.start > span.start
-    }));
-    assert_eq!(fs::read_to_string(path).unwrap(), raw);
-}
-
-#[test]
-fn discovery_diagnoses_legacy_semantics_before_source_rewrite() {
-    let directory = tempfile::tempdir().unwrap();
-    let path = directory.path().join("project.arcadia");
-    let raw = include_str!("fixtures/v3-data-contract.arcadia");
-    fs::write(&path, raw).unwrap();
-    let disk = load_project(&path, ProjectLimits::default()).unwrap();
-    assert_eq!(disk.bundle.files["project.arcadia"], raw);
-    assert!(!disk.diagnostics.is_empty());
-    assert!(
-        disk.diagnostics
-            .iter()
-            .all(|issue| { issue.diagnostic.severity == oa_core::validation::Severity::Warning })
-    );
-    assert_eq!(
-        disk.diagnostics,
-        lint_bundle(&disk.reachable_bundle(), ProjectLimits::default())
-    );
-    let compiled = compile_bundle(&disk.reachable_bundle(), ProjectLimits::default()).unwrap();
-    assert_eq!(compiled.decoded.migration.as_ref().unwrap().from_schema, 3);
-    assert_ne!(compiled.bundle, disk.bundle);
-    for issue in &disk.diagnostics {
-        assert!(compiled.diagnostics.iter().any(|later| {
-            later.diagnostic.code == issue.diagnostic.code
-                && later.diagnostic.object_id == issue.diagnostic.object_id
-                && later.diagnostic.message == issue.diagnostic.message
-        }));
-        let span = issue.diagnostic.span;
-        assert!(raw.get(span.start..span.end).is_some());
-    }
-    // Invalid legacy references still fail during semantic resolution on the
-    // authored bytes; deferring the source rewrite does not hide those errors.
-    let invalid = raw.replace("@coordinate", "@missing");
-    fs::write(&path, &invalid).unwrap();
-    let broken = load_project(&path, ProjectLimits::default()).unwrap();
-    assert!(broken.diagnostics.iter().any(|issue| {
-        issue.diagnostic.severity == oa_core::validation::Severity::Error
-            && issue.diagnostic.message.contains("@missing")
-    }));
-    assert_eq!(broken.bundle.files["project.arcadia"], invalid);
-    assert!(compile_bundle(&broken.reachable_bundle(), ProjectLimits::default()).is_err());
-    assert_eq!(fs::read_to_string(path).unwrap(), invalid);
-}

crates/oa-desktop/Cargo.toml

@@ -18,7 +18,6 @@ serde_json.workspace = true
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 tokio = { version = "1", features = ["rt", "time"] }
 tempfile = "3"
-unicode-segmentation = "1.13.3"
 
 [dev-dependencies]
 iced_runtime = "0.14"

crates/oa-desktop/src/app/checkpoints.rs

@@ -214,11 +214,6 @@ impl App {
             .is_some_and(architecture_authoring::State::inline)
         {
             Task::batch([lint, iced::widget::operation::focus("architecture-name")])
-        } else if self.page == Page::Behavior && self.behavior.source_open() {
-            Task::batch([
-                lint,
-                iced::widget::operation::focus(behavior::source_draft::NAME_INPUT),
-            ])
         } else if self.page == Page::Behavior && self.behavior.creation.created().is_some() {
             Task::batch([
                 lint,

crates/oa-desktop/src/app/hosted.rs

@@ -213,14 +213,6 @@ impl App {
             self.pending = None;
             return Task::none();
         }
-        if self.path.is_some()
-            || self.hosted.session.as_ref().is_none_or(|session| {
-                session.resource_id != remote.resource_id
-                    || session.connection.base() != request.connection.base()
-            })
-        {
-            self.reset_source_navigation_session();
-        }
         self.hosted.session = Some(Session {
             connection: request.connection.clone(),
             resource_id: remote.resource_id,
@@ -353,14 +345,6 @@ impl App {
                         match self.document.apply_compiled((*remote.compiled).clone()) {
                             Ok(_) => {
                                 self.document.mark_saved(remote.compiled.clone());
-                                if self.path.is_some()
-                                    || self.hosted.session.as_ref().is_none_or(|session| {
-                                        session.resource_id != remote.resource_id
-                                            || session.connection.base() != connection.base()
-                                    })
-                                {
-                                    self.reset_source_navigation_session();
-                                }
                                 self.hosted.session = Some(Session {
                                     connection,
                                     resource_id: remote.resource_id,

crates/oa-desktop/src/app/repair_save_state_tests.rs

@@ -1,263 +0,0 @@
-use super::*;
-
-const VALID: &str = concat!(
-    "arcadia 7;\r\n",
-    "project repair \"Repair 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n",
-    "    oa_activity assess \"Assess\" id \"9e8f0000-0000-4000-8000-000000000002\" {}\r\n",
-    "}\r\n",
-);
-
-fn open(app: &mut App, path: &std::path::Path) {
-    let _ = app.update(Message::Loaded(Ok(Some(
-        read_snapshot(path.to_owned()).unwrap(),
-    ))));
-}
-
-fn edit(app: &mut App, text: &str) {
-    let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
-    let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
-        text_editor::Edit::Paste(Arc::new(text.into())),
-    )));
-}
-
-fn save(app: &mut App, path: &std::path::Path) {
-    let receipt = write_snapshot(
-        app.canvas_document,
-        app.document.revision(),
-        app.document.snapshot(),
-        path.to_owned(),
-        app.disk_project.clone(),
-    )
-    .unwrap();
-    let _ = app.update(Message::Saved(Ok(Some(receipt))));
-}
-
-#[test]
-fn repair_to_previous_saved_bytes_requires_save_at_new_destination_and_guards_close() {
-    for extra in [
-        "    include \"missing.arcadia\";\r\n",
-        "    oa_activity assess \"Duplicate\" id \"9e8f0000-0000-4000-8000-000000000003\" {}\r\n",
-    ] {
-        let first = tempfile::tempdir().unwrap();
-        let second = tempfile::tempdir().unwrap();
-        let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
-        let second_path = second
-            .path()
-            .canonicalize()
-            .unwrap()
-            .join("project.arcadia");
-        let invalid = VALID.strip_suffix("}\r\n").unwrap().to_owned() + extra + "}\r\n";
-        std::fs::write(&first_path, VALID).unwrap();
-        std::fs::write(&second_path, &invalid).unwrap();
-        let mut app = App::with_project(Project::empty());
-        open(&mut app, &first_path);
-        assert!(!app.dirty());
-        let before = app.document.snapshot();
-        let revision = app.document.revision();
-        open(&mut app, &second_path);
-        assert!(!app.source_workspace.applied);
-        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
-        edit(&mut app, VALID);
-        assert!(app.apply_source(), "{}", app.status);
-        assert!(app.source_workspace.applied);
-        assert!(!app.source_dirty());
-        assert_eq!(app.document.bundle(), &before.bundle);
-        assert_eq!(app.project(), &before.decoded.project);
-        assert_eq!(app.document.revision(), revision);
-        assert!(
-            !app.document.can_undo(),
-            "Equal content creates no history step"
-        );
-        assert!(app.document.dirty());
-        assert_eq!(app.hosted_label(), "Unsaved changes");
-        assert_eq!(std::fs::read(&second_path).unwrap(), invalid.as_bytes());
-        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
-        let close = window::Id::unique();
-        let task = app.update(Message::Request(Pending::Close(close)));
-        assert!(iced_runtime::task::into_stream(task).is_none());
-        assert!(matches!(app.pending, Some(Pending::Close(id)) if id == close));
-        let _ = app.update(Message::Cancel);
-        save(&mut app, &second_path);
-        assert!(!app.dirty());
-        assert_eq!(app.hosted_label(), "All changes saved");
-        assert_eq!(std::fs::read(&second_path).unwrap(), VALID.as_bytes());
-        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
-    }
-}
-
-#[test]
-fn repair_history_compares_to_new_disk_baseline_and_then_successful_save() {
-    let directory = tempfile::tempdir().unwrap();
-    let path = directory
-        .path()
-        .canonicalize()
-        .unwrap()
-        .join("project.arcadia");
-    std::fs::write(&path, VALID).unwrap();
-    let mut app = App::with_project(Project::empty());
-    open(&mut app, &path);
-    let before = app.document.snapshot();
-    let invalid = format!("{VALID} unfinished {{");
-    std::fs::write(&path, &invalid).unwrap();
-    open(&mut app, &path);
-    let repaired = format!("{VALID}// Repaired rationale\r\n");
-    edit(&mut app, &repaired);
-    assert!(app.apply_source());
-    assert!(app.dirty());
-    let _ = app.update(Message::Undo);
-    assert_eq!(app.document.bundle(), &before.bundle);
-    assert!(
-        app.dirty(),
-        "Old saved bytes are not saved at the repair destination"
-    );
-    let _ = app.update(Message::Redo);
-    assert!(app.dirty());
-    assert_eq!(std::fs::read(&path).unwrap(), invalid.as_bytes());
-
-    std::fs::write(&path, "external edit").unwrap();
-    let failed = write_snapshot(
-        app.canvas_document,
-        app.document.revision(),
-        app.document.snapshot(),
-        path.clone(),
-        app.disk_project.clone(),
-    )
-    .unwrap_err();
-    let _ = app.update(Message::Saved(Err(failed)));
-    assert!(app.dirty());
-    assert_eq!(std::fs::read(&path).unwrap(), b"external edit");
-    std::fs::write(&path, &invalid).unwrap();
-    save(&mut app, &path);
-    assert!(!app.dirty());
-    let _ = app.update(Message::Undo);
-    assert!(app.dirty());
-    assert_eq!(app.document.bundle(), &before.bundle);
-    let _ = app.update(Message::Redo);
-    assert!(!app.dirty(), "Redo to the new saved snapshot is clean");
-    assert_eq!(std::fs::read(&path).unwrap(), repaired.as_bytes());
-}
-
-#[test]
-fn valid_equal_content_at_distinct_destinations_stays_clean() {
-    let first = tempfile::tempdir().unwrap();
-    let second = tempfile::tempdir().unwrap();
-    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
-    let second_path = second
-        .path()
-        .canonicalize()
-        .unwrap()
-        .join("project.arcadia");
-    std::fs::write(&first_path, VALID).unwrap();
-    std::fs::write(&second_path, VALID).unwrap();
-    let mut app = App::with_project(Project::empty());
-    open(&mut app, &first_path);
-    let before = app.document.bundle().clone();
-    open(&mut app, &second_path);
-    assert_eq!(app.document.bundle(), &before);
-    assert_eq!(app.path.as_ref(), Some(&second_path));
-    assert!(!app.dirty());
-    assert_eq!(app.hosted_label(), "All changes saved");
-}
-
-#[test]
-fn recovering_applied_repair_rebinds_rolled_back_disk_bytes_without_changing_model() {
-    let first = tempfile::tempdir().unwrap();
-    let second = tempfile::tempdir().unwrap();
-    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
-    let root = second.path().canonicalize().unwrap();
-    let path = root.join("project.arcadia");
-    let before = VALID.replace("Repair 救援", "Before 救援");
-    std::fs::write(&first_path, VALID).unwrap();
-    std::fs::write(&path, VALID).unwrap();
-    let journal = root.join(".arcadia-save-project.arcadia.journal");
-    std::fs::create_dir(&journal).unwrap();
-    std::fs::write(
-        journal.join("journal.json"),
-        br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":true,"write":true}]}"#,
-    )
-    .unwrap();
-    std::fs::write(journal.join("0.before"), &before).unwrap();
-    std::fs::write(journal.join("0.after"), VALID).unwrap();
-    let mut app = App::with_project(Project::empty());
-    open(&mut app, &first_path);
-    let accepted = app.document.snapshot();
-    open(&mut app, &path);
-    assert_eq!(app.pending_recovery.as_ref(), Some(&path));
-    assert!(!app.source_workspace.applied);
-    assert!(app.apply_source());
-    assert!(
-        !app.dirty(),
-        "Current bytes still match disk before rollback"
-    );
-    let _ = app.update(Message::SourceRecovered(recover_snapshot(path.clone())));
-    assert!(app.pending_recovery.is_none());
-    assert!(!journal.exists());
-    assert_eq!(std::fs::read(&path).unwrap(), before.as_bytes());
-    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    assert!(!app.source_dirty());
-    assert!(app.dirty(), "Recovery changed disk, not the accepted model");
-    assert_eq!(app.hosted_label(), "Unsaved changes");
-    save(&mut app, &path);
-    assert!(!app.dirty());
-    assert_eq!(std::fs::read(&path).unwrap(), VALID.as_bytes());
-}
-
-#[test]
-fn recovery_missing_entry_or_failed_reload_preserves_current_destination_save_authority() {
-    for (current_destination, failed_reload) in
-        [(true, false), (false, false), (true, true), (false, true)]
-    {
-        let directory = tempfile::tempdir().unwrap();
-        let root = directory.path().canonicalize().unwrap();
-        let path = root.join("project.arcadia");
-        std::fs::write(&path, VALID).unwrap();
-        let mut app = App::with_project(Project::empty());
-        open(&mut app, &path);
-        let accepted = app.document.snapshot();
-        let journal = root.join(".arcadia-save-project.arcadia.journal");
-        std::fs::create_dir(&journal).unwrap();
-        std::fs::write(
-            journal.join("journal.json"),
-            br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":false,"write":true}]}"#,
-        )
-        .unwrap();
-        std::fs::write(journal.join("0.after"), VALID).unwrap();
-        open(&mut app, &path);
-        assert!(app.apply_source());
-        assert!(!app.dirty());
-        let destination = tempfile::tempdir().unwrap();
-        let saved_elsewhere = destination
-            .path()
-            .canonicalize()
-            .unwrap()
-            .join("project.arcadia");
-        if !current_destination {
-            save(&mut app, &saved_elsewhere);
-            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
-            assert_eq!(app.pending_recovery.as_ref(), Some(&path));
-        }
-        let mut receipt = recover_snapshot(path.clone()).unwrap();
-        assert!(
-            receipt.disk.as_ref().unwrap().bundle.files.is_empty(),
-            "Missing entry reloads as an empty repair workspace"
-        );
-        if failed_reload {
-            // Separately exercise the adapter's successful-recovery/failed-read
-            // boundary; first-save rollback itself does not cause a read error.
-            receipt.disk = Err("Injected post-recovery reload failure".into());
-        }
-        let _ = app.update(Message::SourceRecovered(Ok(receipt)));
-        assert!(!path.exists());
-        assert!(!journal.exists());
-        assert!(app.pending_recovery.is_none());
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        assert_eq!(app.dirty(), current_destination);
-        if current_destination {
-            let _ = app.update(Message::Request(Pending::New));
-            assert!(matches!(app.pending, Some(Pending::New)));
-        } else {
-            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
-            assert_eq!(std::fs::read(&saved_elsewhere).unwrap(), VALID.as_bytes());
-        }
-    }
-}

crates/oa-desktop/src/app/source_rename/alias_input.rs

@@ -1,219 +0,0 @@
-//! Keep Iced's single-line input from silently filtering pasted control bytes.
-//! Only the alias field uses this adapter. The child retains editing and focus.
-use iced::advanced::{
-    Clipboard, Layout, Shell, Widget, clipboard, layout, overlay, renderer, text, widget,
-};
-use iced::{Element, Event, Length, Rectangle, Size, Vector, keyboard, mouse};
-
-pub(super) fn guard<'a, Message: Clone + 'a, Theme: 'a, R: text::Renderer + 'a>(
-    input: Element<'a, Message, Theme, R>,
-    rejected: Option<Message>,
-) -> Element<'a, Message, Theme, R> {
-    Element::new(AliasInput { input, rejected })
-}
-
-struct AliasInput<'a, Message, Theme, R> {
-    input: Element<'a, Message, Theme, R>,
-    rejected: Option<Message>,
-}
-
-#[derive(Default)]
-struct State {
-    modifiers: keyboard::Modifiers,
-}
-
-// Each fresh child clipboard read uses the checked snapshot. Iced may reuse its
-// previously admitted paste while V is held, until KeyReleased clears that cache.
-struct CapturedClipboard<'a> {
-    content: Option<String>,
-    original: &'a mut dyn Clipboard,
-}
-impl Clipboard for CapturedClipboard<'_> {
-    fn read(&self, kind: clipboard::Kind) -> Option<String> {
-        if kind == clipboard::Kind::Standard {
-            self.content.clone()
-        } else {
-            self.original.read(kind)
-        }
-    }
-    fn write(&mut self, kind: clipboard::Kind, contents: String) {
-        self.original.write(kind, contents);
-    }
-}
-
-impl<Message: Clone, Theme, R: text::Renderer> Widget<Message, Theme, R>
-    for AliasInput<'_, Message, Theme, R>
-{
-    fn size(&self) -> Size<Length> {
-        self.input.as_widget().size()
-    }
-    fn size_hint(&self) -> Size<Length> {
-        self.input.as_widget().size_hint()
-    }
-    fn tag(&self) -> widget::tree::Tag {
-        widget::tree::Tag::of::<State>()
-    }
-    fn state(&self) -> widget::tree::State {
-        widget::tree::State::new(State::default())
-    }
-    fn children(&self) -> Vec<widget::Tree> {
-        vec![widget::Tree::new(self.input.as_widget())]
-    }
-    fn diff(&self, tree: &mut widget::Tree) {
-        tree.diff_children(std::slice::from_ref(&self.input));
-    }
-    fn layout(
-        &mut self,
-        tree: &mut widget::Tree,
-        renderer: &R,
-        limits: &layout::Limits,
-    ) -> layout::Node {
-        self.input
-            .as_widget_mut()
-            .layout(&mut tree.children[0], renderer, limits)
-    }
-    fn draw(
-        &self,
-        tree: &widget::Tree,
-        renderer: &mut R,
-        theme: &Theme,
-        style: &renderer::Style,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-    ) {
-        self.input.as_widget().draw(
-            &tree.children[0],
-            renderer,
-            theme,
-            style,
-            layout,
-            cursor,
-            viewport,
-        );
-    }
-    fn operate(
-        &mut self,
-        tree: &mut widget::Tree,
-        layout: Layout<'_>,
-        renderer: &R,
-        operation: &mut dyn widget::Operation,
-    ) {
-        self.input
-            .as_widget_mut()
-            .operate(&mut tree.children[0], layout, renderer, operation);
-    }
-    fn update(
-        &mut self,
-        tree: &mut widget::Tree,
-        event: &Event,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        renderer: &R,
-        clipboard: &mut dyn Clipboard,
-        shell: &mut Shell<'_, Message>,
-        viewport: &Rectangle,
-    ) {
-        let focused = tree.children[0]
-            .state
-            .downcast_ref::<iced::widget::text_input::State<R::Paragraph>>()
-            .is_focused();
-        let state = tree.state.downcast_mut::<State>();
-        // Iced 0.14.2 uses stored ModifiersChanged state, not KeyPressed.modifiers.
-        // Mirror its Escape reset and its Latin/physical-key paste shortcut.
-        if let Event::Keyboard(keyboard::Event::ModifiersChanged(modifiers)) = event {
-            state.modifiers = *modifiers;
-        }
-        let paste = matches!(event,
-            Event::Keyboard(keyboard::Event::KeyPressed { key, physical_key, .. })
-                if key.to_latin(*physical_key) == Some('v')
-                    && state.modifiers.command() && !state.modifiers.alt());
-        if focused
-            && paste
-            && let Some(rejected) = &self.rejected
-        {
-            let content = clipboard.read(clipboard::Kind::Standard);
-            if content
-                .as_ref()
-                .is_some_and(|value| value.chars().any(char::is_control))
-            {
-                // Do not invoke the child: even an empty replacement would erase
-                // its selection. Approval invalidation is an explicit App event.
-                shell.publish(rejected.clone());
-                shell.capture_event();
-                return;
-            }
-            self.input.as_widget_mut().update(
-                &mut tree.children[0],
-                event,
-                layout,
-                cursor,
-                renderer,
-                &mut CapturedClipboard {
-                    content,
-                    original: clipboard,
-                },
-                shell,
-                viewport,
-            );
-            return;
-        }
-        self.input.as_widget_mut().update(
-            &mut tree.children[0],
-            event,
-            layout,
-            cursor,
-            renderer,
-            clipboard,
-            shell,
-            viewport,
-        );
-        // In Iced 0.14.2 the only KeyPressed branch that removes focus is its
-        // Escape branch, which also resets stored modifiers. Observe that branch
-        // after its text/shortcut early returns and effective-key conversion.
-        if focused
-            && matches!(event, Event::Keyboard(keyboard::Event::KeyPressed { .. }))
-            && !tree.children[0]
-                .state
-                .downcast_ref::<iced::widget::text_input::State<R::Paragraph>>()
-                .is_focused()
-        {
-            tree.state.downcast_mut::<State>().modifiers = keyboard::Modifiers::default();
-        }
-    }
-    fn mouse_interaction(
-        &self,
-        tree: &widget::Tree,
-        layout: Layout<'_>,
-        cursor: mouse::Cursor,
-        viewport: &Rectangle,
-        renderer: &R,
-    ) -> mouse::Interaction {
-        self.input.as_widget().mouse_interaction(
-            &tree.children[0],
-            layout,
-            cursor,
-            viewport,
-            renderer,
-        )
-    }
-    fn overlay<'a>(
-        &'a mut self,
-        tree: &'a mut widget::Tree,
-        layout: Layout<'a>,
-        renderer: &R,
-        viewport: &Rectangle,
-        translation: Vector,
-    ) -> Option<overlay::Element<'a, Message, Theme, R>> {
-        self.input.as_widget_mut().overlay(
-            &mut tree.children[0],
-            layout,
-            renderer,
-            viewport,
-            translation,
-        )
-    }
-}
-
-#[cfg(all(test, debug_assertions))]
-mod tests;

crates/oa-desktop/src/app/source_rename/alias_input/tests.rs

@@ -1,220 +0,0 @@
-use super::*;
-use crate::views::source_tests::FontLayout;
-use iced::keyboard::{
-    Key, Modifiers,
-    key::{Code, Named, Physical},
-};
-use std::cell::Cell;
-
-#[derive(Debug, Clone, PartialEq)]
-enum Signal {
-    Input(String),
-    Rejected,
-}
-
-struct ClipboardText {
-    text: String,
-    reads: Cell<usize>,
-}
-impl Clipboard for ClipboardText {
-    fn read(&self, _: clipboard::Kind) -> Option<String> {
-        self.reads.set(self.reads.get() + 1);
-        Some(self.text.clone())
-    }
-    fn write(&mut self, _: clipboard::Kind, _: String) {}
-}
-type InputState = iced::widget::text_input::State<<FontLayout as text::Renderer>::Paragraph>;
-
-struct Mounted {
-    input: Element<'static, Signal, iced::Theme, FontLayout>,
-    tree: widget::Tree,
-    node: layout::Node,
-    clipboard: ClipboardText,
-    messages: Vec<Signal>,
-}
-impl Mounted {
-    fn new(focused: bool, enabled: bool, modifiers: Modifiers) -> Self {
-        let mut child = iced::widget::text_input("Alias", "send_water");
-        if enabled {
-            child = child.on_input(Signal::Input);
-        }
-        let mut input = guard(child.into(), enabled.then_some(Signal::Rejected));
-        let mut tree = widget::Tree::new(input.as_widget());
-        let node = input.as_widget_mut().layout(
-            &mut tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, Size::new(500., 40.)),
-        );
-        if focused {
-            let state = tree.children[0].state.downcast_mut::<InputState>();
-            state.focus();
-            state.select_range(0, 10);
-        }
-        let mut mounted = Self {
-            input,
-            tree,
-            node,
-            clipboard: ClipboardText {
-                text: "foo\nbar".into(),
-                reads: Cell::new(0),
-            },
-            messages: vec![],
-        };
-        mounted.event(Event::Keyboard(keyboard::Event::ModifiersChanged(
-            modifiers,
-        )));
-        mounted
-    }
-    fn state(&self) -> &InputState {
-        self.tree.children[0].state.downcast_ref::<InputState>()
-    }
-    fn event(&mut self, event: Event) -> bool {
-        let mut shell = Shell::new(&mut self.messages);
-        self.input.as_widget_mut().update(
-            &mut self.tree,
-            &event,
-            Layout::new(&self.node),
-            mouse::Cursor::Unavailable,
-            &FontLayout,
-            &mut self.clipboard,
-            &mut shell,
-            &Rectangle::new(iced::Point::ORIGIN, Size::new(500., 40.)),
-        );
-        shell.is_event_captured()
-    }
-}
-fn key(key: Key, modified_key: Key, code: Code) -> Event {
-    Event::Keyboard(keyboard::Event::KeyPressed {
-        key,
-        modified_key,
-        physical_key: Physical::Code(code),
-        location: keyboard::Location::Standard,
-        modifiers: Modifiers::empty(),
-        text: None,
-        repeat: false,
-    })
-}
-fn paste() -> Event {
-    key(
-        Key::Character("v".into()),
-        Key::Character("v".into()),
-        Code::KeyV,
-    )
-}
-
-#[test]
-fn paste_refusal_matches_child_focus_enabled_and_stored_modifier_protocol() {
-    for focused in [false, true] {
-        for enabled in [false, true] {
-            for modifiers in [
-                Modifiers::empty(),
-                Modifiers::SHIFT,
-                Modifiers::COMMAND,
-                Modifiers::COMMAND | Modifiers::ALT,
-                Modifiers::COMMAND | Modifiers::SHIFT,
-            ] {
-                let mut mounted = Mounted::new(focused, enabled, modifiers);
-                let before = mounted.state().cursor();
-                let expected = focused && enabled && modifiers.command() && !modifiers.alt();
-                let captured = mounted.event(paste());
-                assert_eq!(
-                    mounted.messages,
-                    if expected {
-                        vec![Signal::Rejected]
-                    } else {
-                        vec![]
-                    }
-                );
-                assert_eq!(mounted.clipboard.reads.get(), usize::from(expected));
-                assert_eq!(mounted.state().cursor(), before);
-                if expected {
-                    assert!(captured);
-                }
-            }
-        }
-    }
-}
-
-#[test]
-fn effective_escape_reset_follows_child_after_early_returns() {
-    // Raw Escape mapped to Home must not clear only the guard's Command state.
-    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
-    mounted.event(key(
-        Key::Named(Named::Escape),
-        Key::Named(Named::Home),
-        Code::Escape,
-    ));
-    assert!(mounted.state().is_focused());
-    assert!(mounted.event(paste()));
-    assert_eq!(mounted.messages, vec![Signal::Rejected]);
-
-    // Effective Escape clears both states; a later focus operation does not
-    // invent a new ModifiersChanged event or revive the previous Command state.
-    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
-    mounted.event(key(
-        Key::Named(Named::Home),
-        Key::Named(Named::Escape),
-        Code::Home,
-    ));
-    assert!(!mounted.state().is_focused());
-    mounted.tree.children[0]
-        .state
-        .downcast_mut::<InputState>()
-        .focus();
-    mounted.event(paste());
-    assert!(mounted.messages.is_empty());
-    assert_eq!(mounted.clipboard.reads.get(), 0);
-
-    // Printable text returns before effective Escape and leaves modifiers live.
-    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
-    let mut event = key(
-        Key::Named(Named::Home),
-        Key::Named(Named::Escape),
-        Code::Home,
-    );
-    if let Event::Keyboard(keyboard::Event::KeyPressed { text, .. }) = &mut event {
-        *text = Some("x".into());
-    }
-    mounted.event(event);
-    assert!(mounted.state().is_focused());
-    assert_eq!(mounted.messages, vec![Signal::Input("x".into())]);
-    mounted.messages.clear();
-    mounted.event(paste());
-    assert_eq!(mounted.messages, vec![Signal::Rejected]);
-}
-
-#[test]
-fn held_paste_cache_contains_only_previously_admitted_text() {
-    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
-    mounted.clipboard.text = "water".into();
-    mounted.event(paste());
-    assert_eq!(mounted.messages, vec![Signal::Input("water".into())]);
-    mounted.messages.clear();
-    mounted.clipboard.text = "other".into();
-    mounted.event(paste());
-    assert_eq!(
-        mounted.messages,
-        vec![Signal::Input("waterwater".into())],
-        "Iced reuses its first admitted paste while the key is held"
-    );
-    mounted.messages.clear();
-    let before = mounted.state().cursor();
-    mounted.clipboard.text = "bad\tvalue".into();
-    mounted.event(paste());
-    assert_eq!(mounted.messages, vec![Signal::Rejected]);
-    assert_eq!(mounted.state().cursor(), before);
-    mounted.messages.clear();
-    mounted.event(Event::Keyboard(keyboard::Event::KeyReleased {
-        key: Key::Character("v".into()),
-        modified_key: Key::Character("v".into()),
-        physical_key: Physical::Code(Code::KeyV),
-        location: keyboard::Location::Standard,
-        modifiers: Modifiers::empty(),
-    }));
-    mounted.clipboard.text = "later".into();
-    mounted.event(paste());
-    assert_eq!(
-        mounted.messages,
-        vec![Signal::Input("waterwaterlater".into())]
-    );
-}

crates/oa-desktop/src/app/source_rename/editor_patch.rs

@@ -1,303 +0,0 @@
-//! Display-only reuse after a guarded alias rename. This is not model authority.
-use iced::{advanced::text::Renderer, widget::text_editor};
-use std::sync::Arc;
-
-/// Replace exact, unchanged-line-count source in an existing editor.
-///
-/// The caller must first authorize/commit the model change and must reconstruct
-/// from accepted source on false. Preflight failures do not mutate the editor;
-/// a failed final readback can leave it changed. On changing success the cursor
-/// is at 0:0 without selection; the caller restores its approved origin/reveal.
-/// Direct Content actions deliberately bypass App draft edits and Undo history.
-pub(super) fn replace<R: Renderer>(
-    editor: &mut text_editor::Content<R>,
-    before: &str,
-    after: &str,
-) -> bool {
-    if editor.text() != before {
-        return false;
-    }
-    let Some(old_lines) = lines(before) else {
-        return false;
-    };
-    let Some(new_lines) = lines(after) else {
-        return false;
-    };
-    if old_lines.len() != new_lines.len() || old_lines.len() != editor.line_count() {
-        return false;
-    }
-    let mut patches = Vec::new();
-    for (line, ((old, old_ending), (new, new_ending))) in
-        old_lines.into_iter().zip(new_lines).enumerate()
-    {
-        let Some(actual) = editor.line(line) else {
-            return false;
-        };
-        // Cosmic also recognizes bare CR and LFCR. Comparing the actual lines
-        // catches its greedy LFCR interpretation of e.g. "x\n\r\ny" too.
-        if old_ending != new_ending || actual.text != old || actual.ending != old_ending {
-            return false;
-        }
-        if old == new {
-            continue;
-        }
-        let mut start = old
-            .bytes()
-            .zip(new.bytes())
-            .take_while(|(a, b)| a == b)
-            .count();
-        while !old.is_char_boundary(start) || !new.is_char_boundary(start) {
-            start -= 1;
-        }
-        let mut suffix = old[start..]
-            .bytes()
-            .rev()
-            .zip(new[start..].bytes().rev())
-            .take_while(|(a, b)| a == b)
-            .count();
-        while !old.is_char_boundary(old.len() - suffix) || !new.is_char_boundary(new.len() - suffix)
-        {
-            suffix -= 1;
-        }
-        // All positions and owned payloads are prepared before the first edit.
-        patches.push((
-            line,
-            start,
-            old.len() - suffix,
-            Arc::new(new[start..new.len() - suffix].to_owned()),
-        ));
-    }
-    if patches.is_empty() {
-        return true;
-    }
-    let empty = Arc::new(String::new());
-    for (line, start, end, replacement) in patches.into_iter().rev() {
-        select(editor, line, start, end);
-        editor.perform(text_editor::Action::Edit(text_editor::Edit::Paste(
-            replacement,
-        )));
-    }
-    // Iced overwrites its earliest-change marker on each Edit. An explicit
-    // zero-width selection + empty Paste changes no bytes, but marks line zero.
-    // This also refreshes previously unhighlighted lines before the first patch.
-    // It resets only line zero's text cache; other unchanged lines retain theirs.
-    select(editor, 0, 0, 0);
-    editor.perform(text_editor::Action::Edit(text_editor::Edit::Paste(empty)));
-    editor.text() == after
-}
-
-fn select<R: Renderer>(
-    editor: &mut text_editor::Content<R>,
-    line: usize,
-    start: usize,
-    end: usize,
-) {
-    editor.move_to(text_editor::Cursor {
-        position: text_editor::Position {
-            line,
-            column: start,
-        },
-        // move_to(None) does not clear a previous selection in this Iced version.
-        selection: Some(text_editor::Position { line, column: end }),
-    });
-}
-
-fn lines(source: &str) -> Option<Vec<(&str, text_editor::LineEnding)>> {
-    use text_editor::LineEnding;
-    let mut result = Vec::new();
-    let mut parts = source.split('\n').peekable();
-    while let Some(part) = parts.next() {
-        let (text, ending) = if parts.peek().is_none() {
-            (part, LineEnding::None)
-        } else if let Some(text) = part.strip_suffix('\r') {
-            (text, LineEnding::CrLf)
-        } else {
-            (part, LineEnding::Lf)
-        };
-        if text.contains('\r')
-            || (text.is_empty()
-                && ending == LineEnding::CrLf
-                && result
-                    .last()
-                    .is_some_and(|(_, previous)| *previous == LineEnding::Lf))
-        {
-            return None;
-        }
-        result.push((text, ending));
-    }
-    Some(result)
-}
-
-#[cfg(all(test, debug_assertions))]
-mod tests {
-    use super::*;
-    use crate::views::source_tests::FontLayout;
-    use iced::advanced::{layout, text::Highlighter, widget::Tree};
-    use iced::{Element, Font, Length, Size};
-    use std::{cell::RefCell, ops::Range};
-
-    #[test]
-    fn exact_text_matrix_and_reverse_preserve_endings() {
-        for (before, after) in [
-            ("", ""),
-            ("", "alias"),
-            ("alias", ""),
-            ("same", "same"),
-            ("a\n", "alias\n"),
-            ("a\r\n", "alias\r\n"),
-            ("\r\na\r\n\r\n", "\r\nlong_alias\r\n\r\n"),
-            ("\na\n\n", "\nlong_alias\n\n"),
-            ("a\r\nb\nc", "long_a\r\nlong_b\nlong_c"),
-            (
-                "雨🙂 e\u{301} @a @a // a",
-                "雨🙂 e\u{301} @a_long @a_long // a",
-            ),
-            ("@abc", "@abcdef"),
-            ("@abcdef", "@abc"),
-            ("@abc_suffix", "@def_suffix"),
-            ("@none", "@identifier"),
-            // Shared prefix/suffix bytes inside distinct UTF-8 codepoints must
-            // not be used as String split positions, even outside alias scope.
-            ("雨xé", "雪xê"),
-            ("é", "©"),
-            (
-                "unchanged\n@a\nunchanged\n@a\n",
-                "unchanged\n@long\nunchanged\n@long\n",
-            ),
-        ] {
-            let mut editor = text_editor::Content::<FontLayout>::with_text(before);
-            assert!(
-                replace(&mut editor, before, after),
-                "{before:?} -> {after:?}"
-            );
-            assert_eq!(editor.text(), after);
-            let expected = text_editor::Content::<FontLayout>::with_text(after);
-            assert_eq!(editor.line_count(), expected.line_count());
-            for (actual, expected) in editor.lines().zip(expected.lines()) {
-                assert_eq!(actual.text, expected.text);
-                assert_eq!(actual.ending, expected.ending);
-            }
-            if before != after {
-                assert_eq!(
-                    editor.cursor().position,
-                    text_editor::Position { line: 0, column: 0 }
-                );
-                assert_eq!(editor.cursor().selection, None);
-            }
-            assert!(replace(&mut editor, after, before));
-            assert_eq!(editor.text(), before);
-        }
-    }
-
-    #[test]
-    fn all_preflight_refusals_leave_text_cursor_and_selection_unchanged() {
-        for (actual, before, after) in [
-            ("live", "stale", "changed"),
-            ("a\nb", "a\nb", "long\nb\nc"),
-            ("a\nb", "a\nb", "long\r\nb"),
-            // Refusal on a later line must not apply the earlier planned edit.
-            ("a\nb\r\n", "a\nb\r\n", "long\nb\n"),
-            ("a\rb", "a\rb", "long\rb"),
-            ("a\n\rb", "a\n\rb", "long\n\rb"),
-            ("a\n\r\nb", "a\n\r\nb", "long\n\r\nb"),
-            // The replacement must not introduce a greedy LFCR boundary either.
-            ("a\nx\r\n", "a\nx\r\n", "a\n\r\n"),
-            ("a", "a", "long\r"),
-        ] {
-            let mut editor = text_editor::Content::<FontLayout>::with_text(actual);
-            select(&mut editor, 0, 0, 1);
-            let cursor = editor.cursor();
-            let selection = editor.selection();
-            assert!(
-                !replace(&mut editor, before, after),
-                "{before:?} -> {after:?}"
-            );
-            assert_eq!(editor.text(), actual);
-            assert_eq!(editor.cursor(), cursor);
-            assert_eq!(editor.selection(), selection);
-        }
-    }
-
-    #[test]
-    fn unchanged_content_preserves_selection_and_next_direct_edit_works() {
-        let mut editor = text_editor::Content::<FontLayout>::with_text("@a");
-        select(&mut editor, 0, 1, 2);
-        let cursor = editor.cursor();
-        assert!(replace(&mut editor, "@a", "@a"));
-        assert_eq!(editor.cursor(), cursor);
-        assert!(replace(&mut editor, "@a", "@long"));
-        editor.move_to(text_editor::Cursor {
-            position: text_editor::Position { line: 0, column: 5 },
-            selection: None,
-        });
-        editor.perform(text_editor::Action::Edit(text_editor::Edit::Insert('!')));
-        assert_eq!(editor.text(), "@long!");
-    }
-
-    thread_local! {
-        static CHANGES: RefCell<Vec<usize>> = const { RefCell::new(Vec::new()) };
-    }
-
-    struct Tracked(crate::highlight::ArcadiaHighlighter);
-    impl Highlighter for Tracked {
-        type Settings = Arc<str>;
-        type Highlight = oa_core::language::TokenClass;
-        type Iterator<'a> = std::vec::IntoIter<(Range<usize>, Self::Highlight)>;
-        fn new(settings: &Self::Settings) -> Self {
-            Self(crate::highlight::ArcadiaHighlighter::new(settings))
-        }
-        fn update(&mut self, settings: &Self::Settings) {
-            self.0.update(settings);
-        }
-        fn change_line(&mut self, line: usize) {
-            CHANGES.with(|changes| changes.borrow_mut().push(line));
-            self.0.change_line(line);
-        }
-        fn highlight_line(&mut self, line: &str) -> Self::Iterator<'_> {
-            self.0.highlight_line(line)
-        }
-        fn current_line(&self) -> usize {
-            self.0.current_line()
-        }
-    }
-
-    fn view(
-        editor: &text_editor::Content<FontLayout>,
-        source: Arc<str>,
-    ) -> Element<'_, (), iced::Theme, FontLayout> {
-        text_editor(editor)
-            .font(Font::MONOSPACE)
-            .size(14)
-            .height(Length::Fill)
-            .highlight_with::<Tracked>(source, crate::highlight::format)
-            .into()
-    }
-
-    #[test]
-    fn already_laid_out_editor_notifies_highlighter_from_zero_after_later_line_patch() {
-        let before = "// earlier\n// unmodified\n@a";
-        let after = "// earlier\n// unmodified\n@none";
-        let mut editor = text_editor::Content::<FontLayout>::with_text(before);
-        let limits = layout::Limits::new(Size::ZERO, Size::new(400., 60.));
-        let mut tree = {
-            let mut widget = view(&editor, Arc::from(before));
-            let mut tree = Tree::new(widget.as_widget());
-            let _ = widget
-                .as_widget_mut()
-                .layout(&mut tree, &FontLayout, &limits);
-            tree
-        };
-        CHANGES.with(|changes| changes.borrow_mut().clear());
-        assert!(replace(&mut editor, before, after));
-        {
-            let mut widget = view(&editor, Arc::from(after));
-            let _ = widget
-                .as_widget_mut()
-                .layout(&mut tree, &FontLayout, &limits);
-        }
-        // Font/metrics/bounds are already stable. This notification must come
-        // from the helper's empty edit, not a fresh renderer initialization.
-        CHANGES.with(|changes| assert_eq!(*changes.borrow(), [0]));
-        assert_eq!(editor.text(), after);
-    }
-}

crates/oa-desktop/src/app/source_rename/preview_glyph_tests.rs

@@ -1,449 +0,0 @@
-//! Real paragraph advances and clipping through the actual preview dialog.
-//! Native screenshots additionally check raster ink and the platform renderer.
-use super::*;
-use crate::views::source_tests::FontLayout;
-use iced::advanced::{Layout, layout, renderer, text as shaped, widget};
-use iced::{Background, Color, Font, Pixels, Point, Rectangle, Size, Transformation, Vector};
-use std::collections::{BTreeMap, BTreeSet};
-
-struct Glyph {
-    text: String,
-    paragraph_y: u32,
-    line: usize,
-    bytes: std::ops::Range<usize>,
-    bounds: Rectangle,
-    clip: Rectangle,
-}
-
-struct GlyphRecorder {
-    wanted: BTreeSet<String>,
-    transforms: Vec<Transformation>,
-    clips: Vec<Rectangle>,
-    glyphs: Vec<Glyph>,
-    quads: Vec<Rectangle>,
-}
-impl GlyphRecorder {
-    fn new(wanted: BTreeSet<String>, viewport: Rectangle) -> Self {
-        Self {
-            wanted,
-            transforms: vec![Transformation::IDENTITY],
-            clips: vec![viewport],
-            glyphs: vec![],
-            quads: vec![],
-        }
-    }
-    fn transform(&self) -> Transformation {
-        *self.transforms.last().unwrap()
-    }
-    fn clip(&self, bounds: Rectangle) -> Rectangle {
-        self.clips
-            .last()
-            .unwrap()
-            .intersection(&(bounds * self.transform()))
-            .unwrap_or(Rectangle::with_size(Size::ZERO))
-    }
-}
-impl renderer::Renderer for GlyphRecorder {
-    fn start_layer(&mut self, bounds: Rectangle) {
-        self.clips.push(self.clip(bounds));
-    }
-    fn end_layer(&mut self) {
-        self.clips.pop().unwrap();
-    }
-    fn start_transformation(&mut self, transform: Transformation) {
-        self.transforms.push(self.transform() * transform);
-    }
-    fn end_transformation(&mut self) {
-        self.transforms.pop().unwrap();
-    }
-    fn reset(&mut self, bounds: Rectangle) {
-        self.transforms = vec![Transformation::IDENTITY];
-        self.clips = vec![bounds];
-        self.glyphs.clear();
-        self.quads.clear();
-    }
-    fn fill_quad(&mut self, quad: renderer::Quad, _: impl Into<Background>) {
-        self.quads.push(quad.bounds * self.transform());
-    }
-    fn allocate_image(
-        &mut self,
-        handle: &iced::advanced::image::Handle,
-        callback: impl FnOnce(Result<iced::advanced::image::Allocation, iced::advanced::image::Error>)
-        + Send
-        + 'static,
-    ) {
-        renderer::Renderer::allocate_image(&mut FontLayout, handle, callback);
-    }
-}
-impl shaped::Renderer for GlyphRecorder {
-    type Font = Font;
-    type Paragraph = <FontLayout as shaped::Renderer>::Paragraph;
-    type Editor = <FontLayout as shaped::Renderer>::Editor;
-    const ICON_FONT: Font = <FontLayout as shaped::Renderer>::ICON_FONT;
-    const CHECKMARK_ICON: char = <FontLayout as shaped::Renderer>::CHECKMARK_ICON;
-    const ARROW_DOWN_ICON: char = <FontLayout as shaped::Renderer>::ARROW_DOWN_ICON;
-    const SCROLL_UP_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_UP_ICON;
-    const SCROLL_DOWN_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_DOWN_ICON;
-    const SCROLL_LEFT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_LEFT_ICON;
-    const SCROLL_RIGHT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_RIGHT_ICON;
-    const ICED_LOGO: char = <FontLayout as shaped::Renderer>::ICED_LOGO;
-    fn default_font(&self) -> Font {
-        shaped::Renderer::default_font(&FontLayout)
-    }
-    fn default_size(&self) -> Pixels {
-        shaped::Renderer::default_size(&FontLayout)
-    }
-    fn fill_paragraph(
-        &mut self,
-        paragraph: &Self::Paragraph,
-        position: Point,
-        _: Color,
-        clip: Rectangle,
-    ) {
-        let buffer = paragraph.buffer();
-        let text = buffer
-            .lines
-            .iter()
-            .map(|line| line.text())
-            .collect::<Vec<_>>()
-            .join("\n");
-        if !self.wanted.contains(&text) {
-            return;
-        }
-        let clip = self.clip(clip);
-        for run in buffer.layout_runs() {
-            for glyph in run.glyphs {
-                if run.text[glyph.start..glyph.end]
-                    .chars()
-                    .all(char::is_whitespace)
-                {
-                    continue;
-                }
-                let bounds = Rectangle {
-                    x: position.x + glyph.x + glyph.x_offset * glyph.font_size,
-                    y: position.y + run.line_top,
-                    width: glyph.w,
-                    height: run.line_height,
-                } * self.transform();
-                self.glyphs.push(Glyph {
-                    text: text.clone(),
-                    paragraph_y: position.y.to_bits(),
-                    line: run.line_i,
-                    bytes: glyph.start..glyph.end,
-                    bounds,
-                    clip,
-                });
-            }
-        }
-    }
-    fn fill_editor(
-        &mut self,
-        editor: &Self::Editor,
-        position: Point,
-        color: Color,
-        clip: Rectangle,
-    ) {
-        shaped::Renderer::fill_editor(&mut FontLayout, editor, position, color, clip);
-    }
-    fn fill_text(&mut self, text: shaped::Text, position: Point, color: Color, clip: Rectangle) {
-        shaped::Renderer::fill_text(&mut FontLayout, text, position, color, clip);
-    }
-}
-
-#[derive(Default)]
-struct ScrollGeometry {
-    id: Option<widget::Id>,
-    bounds: Option<Rectangle>,
-    content: Option<Rectangle>,
-    offset: Vector,
-}
-impl widget::Operation for ScrollGeometry {
-    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
-        visit(self);
-    }
-    fn scrollable(
-        &mut self,
-        id: Option<&widget::Id>,
-        bounds: Rectangle,
-        content: Rectangle,
-        offset: Vector,
-        _: &mut dyn widget::operation::Scrollable,
-    ) {
-        if id == self.id.as_ref() {
-            self.bounds = Some(bounds);
-            self.content = Some(content);
-            self.offset = offset;
-        }
-    }
-}
-fn normalized(text: &str) -> String {
-    text.replace("\r\n", "\n").replace('\r', "\n")
-}
-fn required_chars(text: &str) -> BTreeSet<(usize, usize)> {
-    text.split('\n')
-        .enumerate()
-        .flat_map(|(line, text)| {
-            text.char_indices()
-                .filter(|(_, ch)| !ch.is_whitespace())
-                .map(move |(byte, _)| (line, byte))
-        })
-        .collect()
-}
-
-fn declarations(long: bool) -> App {
-    let name = if long {
-        format!("Assess {} request", "界🚀".repeat(90))
-    } else {
-        "Assess 救援 request".into()
-    };
-    let source = SourceBundle { entry: "project.arcadia".into(), files: BTreeMap::from([
-        ("project.arcadia".into(), "arcadia 7;\r\nproject navigation_trial \"Navigation — 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n include \"救援/assess.arcadia\";\r\n}\r\n".into()),
-        ("救援/assess.arcadia".into(), format!("// Comment @assess must not be a lexical use.\r\noa_activity assess \"{name}\" id \"9e8f0000-0000-4000-8000-000000000002\" {{\r\n    description \"Keep @assess as prose, not a use.\";\r\n}}\r\n")),
-    ]) };
-    let mut app = fixture();
-    app.document = Document::from_bundle(source, LIMITS).unwrap();
-    app.source_workspace = Workspace::new(app.document.bundle(), true);
-    app.source_workspace.active = "救援/assess.arcadia".into();
-    app.selected = app.project().id;
-    app.refresh_draft();
-    app.show_source_file(false);
-    let start = app
-        .source_workspace
-        .text()
-        .find("oa_activity assess")
-        .unwrap()
-        + "oa_activity ".len();
-    app.source_editor.move_to(cursor(
-        app.source_workspace.text(),
-        start,
-        start + "assess".len(),
-    ));
-    begin(&mut app);
-    let replacement = if long {
-        "a".repeat(255)
-    } else {
-        "assess_damage".into()
-    };
-    input(&mut app, &replacement);
-    let _ = preview(&mut app);
-    app
-}
-
-fn assert_page_glyphs_visible(app: &App, host: Size) {
-    let form = app.source_rename.form.as_ref().unwrap();
-    let ready = form.approval.as_ref().unwrap();
-    let file = &ready.preview.files()[form.file];
-    let mut expected = BTreeMap::<String, usize>::new();
-    for line in file.hunks()[form.hunk]
-        .lines()
-        .iter()
-        .skip(form.line)
-        .take(LINES_PER_PAGE)
-    {
-        for source in [
-            line.before_text(&ready.prepared.before().bundle.files[file.path()])
-                .unwrap(),
-            line.after_text(&ready.prepared.after().bundle.files[file.path()])
-                .unwrap(),
-        ] {
-            if let Some(fragment) = preview::text_segment(source, form.segment) {
-                let text = normalized(fragment);
-                if !required_chars(&text).is_empty() {
-                    *expected.entry(text).or_default() += 1;
-                }
-            }
-        }
-    }
-    assert!(!expected.is_empty());
-    let viewport = Rectangle::new(Point::ORIGIN, host);
-    let mut renderer = GlyphRecorder::new(expected.keys().cloned().collect(), viewport);
-    let editor = text_editor::Content::<GlyphRecorder>::new();
-    let mut view = dialog_content(app, &editor);
-    let mut tree = widget::Tree::new(view.as_widget());
-    let node =
-        view.as_widget_mut()
-            .layout(&mut tree, &renderer, &layout::Limits::new(Size::ZERO, host));
-    let mut geometry = ScrollGeometry {
-        id: Some(preview_scroll_id(form, ready.id)),
-        ..ScrollGeometry::default()
-    };
-    view.as_widget_mut()
-        .operate(&mut tree, Layout::new(&node), &renderer, &mut geometry);
-    let bounds = geometry.bounds.unwrap();
-    let content = geometry.content.unwrap();
-    assert!(bounds.height >= 40.);
-    let maximum = (content.height - bounds.height).max(0.);
-    let steps = (maximum / (bounds.height * 0.5)).ceil() as usize;
-    let mut visible = BTreeMap::<(String, u32), BTreeSet<(usize, usize)>>::new();
-    let mut reserved_bar_gap = true;
-    for step in 0..=steps {
-        let offset = (step as f32 * bounds.height * 0.5).min(maximum);
-        view.as_widget_mut().operate(
-            &mut tree,
-            Layout::new(&node),
-            &renderer,
-            &mut widget::operation::scrollable::scroll_to(
-                preview_scroll_id(form, ready.id),
-                widget::operation::scrollable::AbsoluteOffset {
-                    x: None,
-                    y: Some(offset),
-                },
-            ),
-        );
-        view.as_widget_mut()
-            .operate(&mut tree, Layout::new(&node), &renderer, &mut geometry);
-        assert!(
-            (geometry.offset.y - offset).abs() <= 0.5,
-            "actual scroll operation reaches the requested source offset"
-        );
-        renderer::Renderer::reset(&mut renderer, viewport);
-        view.as_widget().draw(
-            &tree,
-            &mut renderer,
-            &iced::Theme::Light,
-            &renderer::Style::default(),
-            Layout::new(&node),
-            iced::mouse::Cursor::Unavailable,
-            &viewport,
-        );
-        // The vertical scrollbar's actual painted thumb fixes its excluded x
-        // region; the outer scroll clip alone cannot detect overpainting.
-        let scrollbar_left = renderer
-            .quads
-            .iter()
-            .filter(|quad| {
-                quad.width > 0.
-                    && quad.width <= 16.
-                    && quad.height > 0.
-                    && quad.x >= bounds.x + bounds.width - 18.
-                    && quad.x + quad.width <= bounds.x + bounds.width + 0.5
-                    && quad.y >= bounds.y - 0.5
-                    && quad.y + quad.height <= bounds.y + bounds.height + 0.5
-            })
-            .map(|quad| quad.x)
-            .min_by(f32::total_cmp);
-        if maximum > 0. {
-            let left = scrollbar_left.expect("overflowing actual preview must paint its scrollbar");
-            reserved_bar_gap &= content.x + content.width <= left - 7.5;
-        }
-        for glyph in &renderer.glyphs {
-            let right = glyph.bounds.x + glyph.bounds.width;
-            if let Some(left) = scrollbar_left {
-                assert!(
-                    right <= left - 0.5,
-                    "source glyph under scrollbar: text={:?} cluster={:?} glyph={:?} bar x={left}",
-                    glyph.text,
-                    glyph.bytes,
-                    glyph.bounds
-                );
-            }
-            assert!(
-                glyph.bounds.x >= content.x - 0.5 && right <= content.x + content.width + 0.5,
-                "source glyph escaped reserved width: {:?} {:?}",
-                glyph.text,
-                glyph.bounds
-            );
-            assert!(
-                glyph.bounds.x >= glyph.clip.x - 0.5
-                    && right <= glyph.clip.x + glyph.clip.width + 0.5,
-                "source glyph horizontally clipped: {:?} {:?} {:?}",
-                glyph.text,
-                glyph.bounds,
-                glyph.clip
-            );
-            if glyph.bounds.y >= glyph.clip.y - 0.5
-                && glyph.bounds.y + glyph.bounds.height <= glyph.clip.y + glyph.clip.height + 0.5
-            {
-                let logical_line = glyph.text.split('\n').nth(glyph.line).unwrap();
-                let chars = logical_line
-                    .char_indices()
-                    .filter(|(byte, ch)| glyph.bytes.contains(byte) && !ch.is_whitespace())
-                    .map(|(byte, _)| (glyph.line, byte));
-                visible
-                    .entry((glyph.text.clone(), glyph.paragraph_y))
-                    .or_default()
-                    .extend(chars);
-            }
-        }
-    }
-    assert!(
-        reserved_bar_gap,
-        "source content must reserve actual scrollbar width plus gap"
-    );
-    assert!(
-        bounds.width >= host.width - 30.,
-        "preview must use available dialog width: {bounds:?} / {host:?}"
-    );
-    for (text, count) in expected {
-        let required = required_chars(&text);
-        let instances: Vec<_> = visible
-            .iter()
-            .filter(|((value, _), _)| value == &text)
-            .collect();
-        assert_eq!(
-            instances.len(),
-            count,
-            "all before/after occurrences must be seen: {text:?}"
-        );
-        for (_, seen) in instances {
-            assert_eq!(
-                seen, &required,
-                "every non-whitespace source cluster must be fully visible at some vertical offset: {text:?}"
-            );
-        }
-    }
-}
-
-#[test]
-fn actual_preview_source_glyphs_clear_scrollbar_and_all_long_fragments_are_reachable() {
-    for long in [false, true] {
-        let mut app = declarations(long);
-        let ready = app
-            .source_rename
-            .form
-            .as_ref()
-            .unwrap()
-            .approval
-            .as_ref()
-            .unwrap()
-            .clone();
-        let invocation = app.source_rename.form.as_ref().unwrap().invocation;
-        let before = evidence(&app);
-        for (width, height) in [(1100., 700.), (580., 700.)] {
-            app.window_size = Size::new(width, height);
-            let host = Size::new((width - 84.).min(708.), height - 120.);
-            let total = segment_total(app.source_rename.form.as_ref().unwrap());
-            if long {
-                assert!(
-                    total >= 3,
-                    "include unbroken ASCII and wide Unicode across segments"
-                );
-            }
-            for segment in 0..total {
-                assert_page_glyphs_visible(&app, host);
-                if segment + 1 < total {
-                    event(&mut app, Event::Segment(invocation, ready.id, true));
-                }
-            }
-            for _ in 1..total {
-                event(&mut app, Event::Segment(invocation, ready.id, false));
-            }
-        }
-        assert_eq!(
-            evidence(&app),
-            before,
-            "preview geometry/paging cannot alter transaction inputs"
-        );
-        assert_eq!(
-            app.source_rename
-                .form
-                .as_ref()
-                .unwrap()
-                .approval
-                .as_ref()
-                .unwrap()
-                .id,
-            ready.id
-        );
-    }
-}

crates/oa-desktop/src/app/source_rename/preview_scroll_tests.rs

@@ -1,310 +0,0 @@
-//! Execute the controller's scroll operations on a retained, scrolled dialog.
-use super::*;
-use crate::views::source_tests::FontLayout;
-use iced::advanced::{Layout, layout, widget};
-use iced::futures::StreamExt;
-use iced::{Rectangle, Size, Vector};
-
-const HOST: Size = Size::new(720., 660.);
-
-fn paged_fixture() -> App {
-    let mut source = bundle();
-    let name = "Long engineering name 雨 ".repeat(18);
-    source.files.get_mut("defs.arcadia").unwrap().replace_range(
-        ..,
-        &format!(
-            "oa_activity pump \"{name}\" id \"00000000-0000-0000-0000-000000000002\" {{}}\r\n\
-            oa_activity backup \"Backup\" id \"00000000-0000-0000-0000-000000000004\" {{}}\r\n"
-        ),
-    );
-    let mut uses = String::new();
-    for index in 0..16 {
-        if index == 12 {
-            uses.push_str(&"// unchanged gap\r\n".repeat(10));
-        }
-        uses.push_str(&format!(
-            "interaction use_{index} \"{name}\" id \"00000000-0000-0000-0001-{index:012}\" {{ source @pump; target @backup; }}\r\n"
-        ));
-    }
-    source.files.insert("uses.arcadia".into(), uses);
-    let mut app = fixture();
-    app.window_size = HOST;
-    app.document = Document::from_bundle(source, LIMITS).unwrap();
-    app.source_workspace = Workspace::new(app.document.bundle(), true);
-    app.source_workspace.active = "uses.arcadia".into();
-    app.show_source_file(false);
-    let start = app.source_workspace.text().find("source @pump").unwrap() + "source @".len();
-    app.source_editor
-        .move_to(cursor(app.source_workspace.text(), start, start + 4));
-    begin(&mut app);
-    input(&mut app, "pump_long");
-    let _ = preview(&mut app);
-    app
-}
-
-fn scroll_id(app: &App) -> widget::Id {
-    let form = app.source_rename.form.as_ref().unwrap();
-    preview_scroll_id(form, form.approval.as_ref().unwrap().id)
-}
-
-struct Geometry {
-    id: widget::Id,
-    offset: Option<Vector>,
-}
-impl widget::Operation for Geometry {
-    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
-        visit(self);
-    }
-    fn scrollable(
-        &mut self,
-        id: Option<&widget::Id>,
-        _: Rectangle,
-        _: Rectangle,
-        offset: Vector,
-        _: &mut dyn widget::operation::Scrollable,
-    ) {
-        if id == Some(&self.id) {
-            self.offset = Some(offset);
-        }
-    }
-}
-
-struct Mounted {
-    editor: text_editor::Content<FontLayout>,
-    tree: widget::Tree,
-}
-impl Mounted {
-    fn new(app: &App) -> Self {
-        let editor = text_editor::Content::<FontLayout>::new();
-        let tree = widget::Tree::new(dialog_content(app, &editor).as_widget());
-        Self { editor, tree }
-    }
-    fn operate(&mut self, app: &App, operation: &mut dyn widget::Operation) {
-        let mut view = dialog_content(app, &self.editor);
-        // Preserve the actual scroll state across the new page's view diff.
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        view.as_widget_mut()
-            .operate(&mut self.tree, Layout::new(&node), &FontLayout, operation);
-    }
-    fn offset(&mut self, app: &App) -> f32 {
-        let mut geometry = Geometry {
-            id: scroll_id(app),
-            offset: None,
-        };
-        self.operate(app, &mut geometry);
-        geometry.offset.expect("mounted preview scrollable").y
-    }
-    fn scroll_down(&mut self, app: &App) -> f32 {
-        self.operate(
-            app,
-            &mut widget::operation::scrollable::scroll_to(
-                scroll_id(app),
-                widget::operation::scrollable::AbsoluteOffset {
-                    x: None,
-                    y: Some(10_000.),
-                },
-            ),
-        );
-        let offset = self.offset(app);
-        assert!(offset > 10., "fixture must really be scrolled");
-        offset
-    }
-    async fn execute(&mut self, app: &App, task: Task<Message>) -> usize {
-        let mut count = 0;
-        if let Some(mut actions) = iced_runtime::task::into_stream(task) {
-            while let Some(action) = actions.next().await {
-                let iced_runtime::Action::Widget(mut operation) = action else {
-                    panic!("preview paging must only schedule a widget operation");
-                };
-                self.operate(app, operation.as_mut());
-                count += 1;
-            }
-        }
-        count
-    }
-}
-
-#[tokio::test]
-async fn explicit_navigation_resets_retained_scroll_but_id_change_alone_does_not() {
-    let mut app = paged_fixture();
-    let before = evidence(&app);
-    let form = app.source_rename.form.as_ref().unwrap();
-    let invocation = form.invocation;
-    let approval = form.approval.as_ref().unwrap().id;
-    let mut mounted = Mounted::new(&app);
-    mounted.scroll_down(&app);
-    let old_id = scroll_id(&app);
-    let task = app.update(Message::SourceRename(Event::File(
-        invocation, approval, true,
-    )));
-    assert_ne!(old_id, scroll_id(&app));
-    // Negative control: even after diff/layout with the new id and new file,
-    // Iced retains the previous offset until the returned operation executes.
-    assert!(mounted.offset(&app) > 10.);
-    assert_eq!(mounted.execute(&app, task).await, 1);
-    assert_eq!(mounted.offset(&app), 0.);
-
-    for navigation in [
-        Event::Line(invocation, approval, true),
-        Event::Segment(invocation, approval, true),
-        Event::Hunk(invocation, approval, true),
-        Event::File(invocation, approval, false),
-        Event::Search(invocation, "uses".into()),
-        Event::Search(invocation, "no-path-match".into()),
-        Event::Search(invocation, String::new()),
-    ] {
-        mounted.scroll_down(&app);
-        let task = app.update(Message::SourceRename(navigation));
-        assert_eq!(mounted.execute(&app, task).await, 1);
-        assert_eq!(mounted.offset(&app), 0.);
-        assert_eq!(evidence(&app), before);
-    }
-    // Passive redraw and unchanged filter input preserve deliberate scrolling.
-    let offset = mounted.scroll_down(&app);
-    assert_eq!(mounted.offset(&app), offset);
-    let task = app.update(Message::SourceRename(Event::Search(
-        invocation,
-        String::new(),
-    )));
-    assert_eq!(mounted.execute(&app, task).await, 0);
-    assert_eq!(mounted.offset(&app), offset);
-    let task = app.update(Message::SourceRename(Event::Input(
-        invocation,
-        "pump_long".into(),
-    )));
-    assert_eq!(mounted.execute(&app, task).await, 0);
-    assert_eq!(mounted.offset(&app), offset);
-    let task = app.update(Message::SourceRename(Event::File(
-        invocation, approval, false,
-    )));
-    assert_eq!(
-        mounted.execute(&app, task).await,
-        0,
-        "clamped first-page request is a no-op"
-    );
-    assert_eq!(mounted.offset(&app), offset);
-    assert_eq!(evidence(&app), before);
-}
-
-#[tokio::test]
-async fn delayed_page_and_approval_operations_cannot_reset_a_new_destination() {
-    let mut app = paged_fixture();
-    let before = evidence(&app);
-    let form = app.source_rename.form.as_ref().unwrap();
-    let invocation = form.invocation;
-    let old_approval = form.approval.as_ref().unwrap().id;
-    let mut mounted = Mounted::new(&app);
-    let old_page_task = app.update(Message::SourceRename(Event::File(
-        invocation,
-        old_approval,
-        true,
-    )));
-    let next_page_task = app.update(Message::SourceRename(Event::Line(
-        invocation,
-        old_approval,
-        true,
-    )));
-    assert_eq!(mounted.execute(&app, next_page_task).await, 1);
-    let offset = mounted.scroll_down(&app);
-    assert_eq!(mounted.execute(&app, old_page_task).await, 1);
-    assert_eq!(mounted.offset(&app), offset, "old page target is absent");
-
-    let old_approval_task = app.update(Message::SourceRename(Event::Search(
-        invocation,
-        "defs".into(),
-    )));
-    input(&mut app, "pump_new");
-    let _ = preview(&mut app); // Real new approval in the same invocation/page.
-    assert_ne!(
-        app.source_rename
-            .form
-            .as_ref()
-            .unwrap()
-            .approval
-            .as_ref()
-            .unwrap()
-            .id,
-        old_approval
-    );
-    let offset = mounted.scroll_down(&app);
-    assert_eq!(mounted.execute(&app, old_approval_task).await, 1);
-    assert_eq!(
-        mounted.offset(&app),
-        offset,
-        "old approval target is absent"
-    );
-    let task = app.update(Message::SourceRename(Event::File(
-        invocation,
-        old_approval,
-        true,
-    )));
-    assert_eq!(
-        mounted.execute(&app, task).await,
-        0,
-        "stale envelope is rejected before scheduling"
-    );
-    assert_eq!(mounted.offset(&app), offset);
-    assert_eq!(evidence(&app), before);
-}
-
-#[tokio::test]
-async fn repeated_page_visits_filters_and_fast_preview_completion_have_distinct_destinations() {
-    let mut app = paged_fixture();
-    let before = evidence(&app);
-    let form = app.source_rename.form.as_ref().unwrap();
-    let invocation = form.invocation;
-    let approval = form.approval.as_ref().unwrap().id;
-    let mut mounted = Mounted::new(&app);
-
-    let first_visit = app.update(Message::SourceRename(Event::File(
-        invocation, approval, true,
-    )));
-    let next_page = app.update(Message::SourceRename(Event::Line(
-        invocation, approval, true,
-    )));
-    assert_eq!(mounted.execute(&app, next_page).await, 1);
-    let return_visit = app.update(Message::SourceRename(Event::Line(
-        invocation, approval, false,
-    )));
-    assert_eq!(mounted.execute(&app, return_visit).await, 1);
-    let offset = mounted.scroll_down(&app);
-    assert_eq!(mounted.execute(&app, first_visit).await, 1);
-    assert_eq!(
-        mounted.offset(&app),
-        offset,
-        "old visit to the identical page is stale"
-    );
-
-    let old_filter = app.update(Message::SourceRename(Event::Search(
-        invocation,
-        "uses".into(),
-    )));
-    let new_filter = app.update(Message::SourceRename(Event::Search(
-        invocation,
-        "us".into(),
-    )));
-    assert_eq!(mounted.execute(&app, new_filter).await, 1);
-    let offset = mounted.scroll_down(&app);
-    assert_eq!(mounted.execute(&app, old_filter).await, 1);
-    assert_eq!(
-        mounted.offset(&app),
-        offset,
-        "old filter on the same page is stale"
-    );
-
-    input(&mut app, "pump_new");
-    let job = start_preview(&mut app);
-    let completion = preview_completion(&app, job);
-    // No intermediate frame mounts the temporary no-approval view. The old
-    // Scrollable survives even though the new approval has a different id.
-    let ready = app.update(Message::SourceRenameReady(completion));
-    assert!(mounted.offset(&app) > 10.);
-    assert_eq!(mounted.execute(&app, ready).await, 1);
-    assert_eq!(mounted.offset(&app), 0.);
-    assert_eq!(evidence(&app), before);
-}

crates/oa-desktop/src/app/source_rename_layout_timing_tests.rs

@@ -1,313 +0,0 @@
-//! Manual replacement + next-layout/highlight evaluator; no GPU or native paint.
-//! Child of source_rename_timing_tests, preserving the separate real App test.
-use super::*;
-use crate::{highlight, views::source_tests::FontLayout};
-use iced::advanced::widget::operation::Focusable;
-use iced::advanced::{Layout, graphics, layout, renderer, text as shaped, widget::Tree};
-use iced::{
-    Background, Color, Element, Font, Length, Pixels, Point, Rectangle, Size, Transformation,
-};
-
-// The same real Paragraph and Editor as FontLayout. During draw, retain only a
-// Weak and fixed geometry; inspect glyphs after timing, never in fill_editor.
-#[derive(Default)]
-struct ObservedFontLayout {
-    drawn: Option<(graphics::text::editor::Weak, Point, Rectangle)>,
-}
-impl renderer::Renderer for ObservedFontLayout {
-    fn start_layer(&mut self, _: Rectangle) {}
-    fn end_layer(&mut self) {}
-    fn start_transformation(&mut self, _: Transformation) {}
-    fn end_transformation(&mut self) {}
-    fn reset(&mut self, _: Rectangle) {
-        self.drawn = None;
-    }
-    fn fill_quad(&mut self, _: renderer::Quad, _: impl Into<Background>) {}
-    fn allocate_image(
-        &mut self,
-        handle: &iced::advanced::image::Handle,
-        callback: impl FnOnce(Result<iced::advanced::image::Allocation, iced::advanced::image::Error>)
-        + Send
-        + 'static,
-    ) {
-        renderer::Renderer::allocate_image(&mut FontLayout, handle, callback);
-    }
-}
-impl shaped::Renderer for ObservedFontLayout {
-    type Font = Font;
-    type Paragraph = <FontLayout as shaped::Renderer>::Paragraph;
-    type Editor = <FontLayout as shaped::Renderer>::Editor;
-    const ICON_FONT: Font = <FontLayout as shaped::Renderer>::ICON_FONT;
-    const CHECKMARK_ICON: char = <FontLayout as shaped::Renderer>::CHECKMARK_ICON;
-    const ARROW_DOWN_ICON: char = <FontLayout as shaped::Renderer>::ARROW_DOWN_ICON;
-    const SCROLL_UP_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_UP_ICON;
-    const SCROLL_DOWN_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_DOWN_ICON;
-    const SCROLL_LEFT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_LEFT_ICON;
-    const SCROLL_RIGHT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_RIGHT_ICON;
-    const ICED_LOGO: char = <FontLayout as shaped::Renderer>::ICED_LOGO;
-    fn default_font(&self) -> Font {
-        shaped::Renderer::default_font(&FontLayout)
-    }
-    fn default_size(&self) -> Pixels {
-        shaped::Renderer::default_size(&FontLayout)
-    }
-    fn fill_paragraph(&mut self, _: &Self::Paragraph, _: Point, _: Color, _: Rectangle) {}
-    fn fill_editor(&mut self, editor: &Self::Editor, position: Point, _: Color, clip: Rectangle) {
-        self.drawn = Some((editor.downgrade(), position, clip));
-    }
-    fn fill_text(&mut self, _: shaped::Text, _: Point, _: Color, _: Rectangle) {}
-}
-
-type Content = text_editor::Content<ObservedFontLayout>;
-const HOST: Size = Size::new(640., 350.);
-
-fn view(editor: &Content, source: Arc<str>) -> Element<'_, (), iced::Theme, ObservedFontLayout> {
-    text_editor(editor)
-        .on_action(|_| ())
-        .font(Font::MONOSPACE)
-        .size(14)
-        .padding(16)
-        .height(Length::Fill)
-        .highlight_with::<highlight::ArcadiaHighlighter>(source, highlight::format)
-        .into()
-}
-
-fn check_text(editor: &Content, expected: &str, cursor: text_editor::Cursor) {
-    assert_eq!(editor.text(), expected);
-    assert_eq!(editor.cursor(), cursor);
-    let lines: Vec<_> = expected.split('\n').collect();
-    assert_eq!(editor.line_count(), lines.len());
-    for (index, part) in lines.iter().enumerate() {
-        let (text, ending) = if index + 1 == lines.len() {
-            (*part, text_editor::LineEnding::None)
-        } else if let Some(text) = part.strip_suffix('\r') {
-            (text, text_editor::LineEnding::CrLf)
-        } else {
-            (*part, text_editor::LineEnding::Lf)
-        };
-        let actual = editor.line(index).unwrap();
-        assert_eq!(actual.text, text);
-        assert_eq!(actual.ending, ending);
-    }
-}
-
-fn check_draw(renderer: &ObservedFontLayout, cursor: text_editor::Cursor, alias: &str) {
-    let (weak, position, clip) = renderer.drawn.as_ref().expect("real editor draw");
-    let editor = weak.upgrade().expect("drawn editor is still live");
-    let buffer = editor.buffer();
-    assert_eq!(weak.bounds, Size::new(608., 318.));
-    assert_eq!(buffer.size(), (Some(608.), Some(318.)));
-    assert_eq!(buffer.metrics().font_size, 14.);
-    assert_eq!(
-        buffer.scroll().horizontal,
-        0.,
-        "fixture origin fits the viewport"
-    );
-    let start = cursor.position;
-    let end = cursor.selection.expect("approved alias selection");
-    assert_eq!(start.line, end.line);
-    assert_eq!(end.column - start.column, alias.len());
-    let line = &buffer.lines[start.line];
-    assert_eq!(&line.text()[start.column..end.column], alias);
-    let color = graphics::text::to_color(Color::from_rgb8(20, 93, 139));
-    let font = graphics::text::to_attributes(Font::MONOSPACE);
-    for byte in start.column..end.column {
-        let attrs = line.attrs_list().get_span(byte);
-        assert_eq!(
-            attrs.color_opt,
-            Some(color),
-            "accepted alias syntax attributes"
-        );
-        assert_eq!(attrs.family, font.family);
-    }
-    let mut covered = vec![false; alias.len()];
-    for run in buffer.layout_runs().filter(|run| run.line_i == start.line) {
-        for glyph in run.glyphs {
-            let from = glyph.start.max(start.column);
-            let to = glyph.end.min(end.column);
-            if from >= to {
-                continue;
-            }
-            assert_eq!(glyph.color_opt, Some(color), "drawn alias glyph color");
-            let x = position.x + glyph.x + glyph.x_offset * glyph.font_size;
-            let y = position.y + run.line_top;
-            assert!(x >= clip.x - 0.5 && x + glyph.w <= clip.x + clip.width + 0.5);
-            assert!(y + run.line_height > clip.y && y < clip.y + clip.height);
-            covered[from - start.column..to - start.column].fill(true);
-        }
-    }
-    assert!(
-        covered.into_iter().all(|seen| seen),
-        "entire alias has visible shaped glyphs"
-    );
-    // This temporary strong upgrade is dropped before the next editor mutation.
-}
-
-#[derive(Clone, Copy)]
-enum Arm {
-    Constructor,
-    Reuse,
-}
-impl Arm {
-    fn name(self) -> &'static str {
-        match self {
-            Self::Constructor => "with_text",
-            Self::Reuse => "same_line_reuse",
-        }
-    }
-    fn phases(self) -> [&'static str; 4] {
-        match self {
-            Self::Constructor => [
-                "constructor_replace_origin",
-                "constructor_next_layout",
-                "constructor_highlight_draw",
-                "constructor_combined",
-            ],
-            Self::Reuse => [
-                "reuse_replace_origin",
-                "reuse_next_layout",
-                "reuse_highlight_draw",
-                "reuse_combined",
-            ],
-        }
-    }
-}
-
-fn trial(
-    fixture: &Fixture,
-    cursor: text_editor::Cursor,
-    arm: Arm,
-    trial: usize,
-    samples: &mut Samples,
-) {
-    let before = &fixture.bundle.files[ORIGIN];
-    let after = &fixture.expected_bundle.files[ORIGIN];
-    let mut editor = Content::with_text(before);
-    editor.move_to(fixture.cursor);
-    let mut renderer = ObservedFontLayout::default();
-    let theme = iced::Theme::Light;
-    let defaults = renderer::Style::default();
-    let viewport = Rectangle::with_size(HOST);
-    let limits = layout::Limits::new(Size::ZERO, HOST);
-    let mut tree = {
-        let mut widget = view(&editor, Arc::from(before.as_str()));
-        let mut tree = Tree::new(widget.as_widget());
-        let node = widget.as_widget_mut().layout(&mut tree, &renderer, &limits);
-        tree.state
-            .downcast_mut::<text_editor::State<highlight::ArcadiaHighlighter>>()
-            .focus();
-        widget.as_widget().draw(
-            &tree,
-            &mut renderer,
-            &theme,
-            &defaults,
-            Layout::new(&node),
-            iced::mouse::Cursor::Unavailable,
-            &viewport,
-        );
-        tree
-    };
-    check_text(&editor, before, fixture.cursor);
-    check_draw(&renderer, fixture.cursor, OLD);
-    // No recorder Weak/Strong from setup may perturb replacement ownership.
-    renderer.drawn = None;
-    let next_source: Arc<str> = Arc::from(after.as_str());
-
-    // Only normal operations and four timestamps occur between start and end.
-    // Source/model oracles, logging and recorder glyph inspection are outside.
-    let started = Instant::now();
-    let replaced = match arm {
-        Arm::Constructor => {
-            editor = Content::with_text(after);
-            true
-        }
-        Arm::Reuse => super::super::editor_patch::replace(&mut editor, before, after),
-    };
-    editor.move_to(cursor);
-    let replaced_at = Instant::now();
-    let mut widget = view(&editor, next_source);
-    let node = widget.as_widget_mut().layout(&mut tree, &renderer, &limits);
-    let laid_out_at = Instant::now();
-    widget.as_widget().draw(
-        &tree,
-        &mut renderer,
-        &theme,
-        &defaults,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &viewport,
-    );
-    let drawn_at = Instant::now();
-    drop(widget);
-
-    assert!(replaced, "reuse must not silently time a fallback/refusal");
-    check_text(&editor, after, cursor);
-    check_draw(&renderer, cursor, NEW);
-    renderer.drawn = None;
-    for (phase, duration) in arm.phases().into_iter().zip([
-        replaced_at.duration_since(started),
-        laid_out_at.duration_since(replaced_at),
-        drawn_at.duration_since(laid_out_at),
-        drawn_at.duration_since(started),
-    ]) {
-        println!(
-            "{}",
-            serde_json::json!({
-                "record": "editor_layout_timing", "arm": arm.name(), "phase": phase,
-                "trial": trial, "warmup": trial == 0,
-                "elapsed_ns": duration.as_nanos().to_string(),
-                "elapsed_ms": duration.as_secs_f64() * 1000.0,
-            })
-        );
-        if trial != 0 {
-            samples.0.entry(phase).or_default().push(duration);
-        }
-    }
-}
-
-#[test]
-#[ignore = "manual Windows dev/debug editor replacement + layout/highlight trial; run alone with --ignored --nocapture --test-threads=1"]
-fn accepted_release1_constructor_vs_reuse_through_next_highlight() {
-    let fixture = Fixture::load();
-    // Resolve the exact production approval and verify full Project/source once,
-    // outside all intervals. The actual App Confirm evaluator remains separate.
-    let cursor = {
-        let app = fixture.app();
-        let target = resolve(&app, &app.rename_context());
-        let prepared = app
-            .document
-            .alias_rename_request(target.id, NEW.into())
-            .unwrap()
-            .prepare()
-            .unwrap();
-        fixture.check_candidate(&prepared);
-        prepare_approval(prepared, &target, ORIGIN).unwrap().cursor
-    };
-    println!(
-        "{}",
-        serde_json::json!({
-            "record": "editor_layout_fixture", "host_width": HOST.width, "host_height": HOST.height,
-            "font": "MONOSPACE", "font_size": 14, "padding": 16, "height": "Fill",
-            "active_file": ORIGIN, "before_bytes": fixture.bundle.files[ORIGIN].len(),
-            "after_bytes": fixture.expected_bundle.files[ORIGIN].len(), "warmups_per_arm": 1,
-            "measured_trials_per_arm": 5, "debug_assertions": cfg!(debug_assertions),
-            "scope": "real editor replacement, retained Tree layout and Widget draw/highlight; no GPU, native paint or App Confirm",
-        })
-    );
-    let mut samples = Samples::default();
-    for index in 0..=5 {
-        let arms = if index % 2 == 0 {
-            [Arm::Constructor, Arm::Reuse]
-        } else {
-            [Arm::Reuse, Arm::Constructor]
-        };
-        println!(
-            "{}",
-            serde_json::json!({"record": "editor_layout_order", "trial": index, "first": arms[0].name()})
-        );
-        for arm in arms {
-            trial(&fixture, cursor, arm, index, &mut samples);
-        }
-    }
-    samples.report();
-}

crates/oa-desktop/src/app/source_rename_timing_tests.rs

@@ -1,347 +0,0 @@
-//! Manual timing through the real Document and App paths. No disk writes,
-//! executor polling, layout, GPU work or first-paint measurement occurs here.
-//! Register as a test child of app::source_rename to use its actual worker helpers.
-use super::*;
-use crate::source_workspace::Workspace;
-use oa_core::source_project::SourceBundle;
-use std::{
-    collections::BTreeMap,
-    path::PathBuf,
-    time::{Duration, Instant},
-};
-
-#[cfg(debug_assertions)]
-#[path = "source_rename_layout_timing_tests.rs"]
-mod layout_timing_tests;
-
-const OLD: &str = "oa_restore_work";
-const NEW: &str = "oa_restore_pressure";
-const DECLARATIONS: &str = "oa/activities/activity_oa_restore_work.arcadia";
-const ORIGIN: &str = "traceability.arcadia";
-
-struct Fixture {
-    bundle: SourceBundle,
-    project: Project,
-    expected_bundle: SourceBundle,
-    expected_project: Project,
-    target: Id,
-    cursor: text_editor::Cursor,
-}
-
-impl Fixture {
-    fn load() -> Self {
-        // The optional entry selects a parent-pinned copy of this exact fixture,
-        // not an arbitrary performance generator or a mutable GUI destination.
-        let entry = std::env::var_os("ARCADIA_RENAME_TIMING_ENTRY")
-            .map(PathBuf::from)
-            .unwrap_or_else(|| {
-                PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-                    .join("../../examples/release1/project.arcadia")
-            });
-        let loaded = oa_core::source_files::load_project(&entry, LIMITS).unwrap();
-        let bundle = loaded.reachable_bundle();
-        assert_eq!(
-            bundle.files.len(),
-            30,
-            "use the preserved release1 walkthrough"
-        );
-        let document = Document::from_bundle(bundle.clone(), LIMITS).unwrap();
-        assert_eq!(
-            document.bundle(),
-            &bundle,
-            "fixture must need no stabilization/migration"
-        );
-        assert!(!document.dirty());
-        let project = document.project().clone();
-        let target = Id::parse_str("1b91f8a7-0bdb-514e-b1cd-955658e09927").unwrap();
-        assert_eq!(project.elements[&target].alias, OLD);
-        assert!(!project.identities().iter().any(|(_, alias)| *alias == NEW));
-        let mut expected_project = project.clone();
-        expected_project.elements.get_mut(&target).unwrap().alias = NEW.into();
-
-        // Independent literal source oracle, authored before running the rename.
-        // Do not replace the alias substring in filenames or the trace's alias.
-        let mut expected_bundle = bundle.clone();
-        let declarations = expected_bundle.files.get_mut(DECLARATIONS).unwrap();
-        assert_eq!(
-            declarations.matches("oa_activity oa_restore_work ").count(),
-            1
-        );
-        assert_eq!(declarations.matches("parent @oa_restore_work;").count(), 4);
-        *declarations = declarations
-            .replace(
-                "oa_activity oa_restore_work ",
-                "oa_activity oa_restore_pressure ",
-            )
-            .replace("parent @oa_restore_work;", "parent @oa_restore_pressure;");
-        let traces = expected_bundle.files.get_mut(ORIGIN).unwrap();
-        assert_eq!(traces.matches("oa @oa_restore_work;").count(), 1);
-        *traces = traces.replace("oa @oa_restore_work;", "oa @oa_restore_pressure;");
-        let source = &bundle.files[ORIGIN];
-        let start = source.rfind("@oa_restore_work;").unwrap() + 1;
-        let position = |offset| {
-            let prefix = &source[..offset];
-            text_editor::Position {
-                line: prefix.bytes().filter(|byte| *byte == b'\n').count(),
-                column: prefix
-                    .rsplit_once('\n')
-                    .map_or(prefix.len(), |(_, tail)| tail.len()),
-            }
-        };
-        let cursor = text_editor::Cursor {
-            position: position(start),
-            selection: Some(position(start + OLD.len())),
-        };
-        assert!(nav::exact_cursor(source, cursor));
-        println!(
-            "{}",
-            serde_json::json!({
-                "record": "fixture", "entry": entry, "reachable_files": bundle.files.len(),
-                "source_bytes": bundle.files.values().map(String::len).sum::<usize>(),
-                "identities": project.identities().len(), "active_file": ORIGIN,
-                "active_file_bytes": source.len(), "old": OLD, "new": NEW,
-                "warmups": 1, "measured_trials": 5, "debug_assertions": cfg!(debug_assertions),
-                "scope": "real worker helpers, guarded Document commit, App sync and Confirm update; no task polling or rendering"
-            })
-        );
-        Self {
-            bundle,
-            project,
-            expected_bundle,
-            expected_project,
-            target,
-            cursor,
-        }
-    }
-
-    fn app(&self) -> App {
-        let mut app = App::with_project(Project::empty());
-        app.document = Document::from_bundle(self.bundle.clone(), LIMITS).unwrap();
-        app.source_workspace = Workspace::new(app.document.bundle(), true);
-        app.source_workspace.active = ORIGIN.into();
-        app.selected = app.project().id;
-        app.page = Page::Text;
-        app.sync();
-        app.source_editor.move_to(self.cursor);
-        assert_eq!(app.project(), &self.project);
-        assert_eq!(app.document.bundle(), &self.bundle);
-        assert_eq!(app.document.revision(), 0);
-        assert!(!app.document.dirty() && !app.document.can_undo() && !app.document.can_redo());
-        assert!(app.rename_admission().is_ok());
-        app
-    }
-
-    fn check_candidate(&self, prepared: &PreparedAliasRename) {
-        assert!(prepared.changed());
-        assert_eq!(prepared.before().bundle, self.bundle);
-        assert_eq!(prepared.before().decoded.project, self.project);
-        assert_eq!(prepared.after().bundle, self.expected_bundle);
-        assert_eq!(prepared.after().decoded.project, self.expected_project);
-    }
-
-    fn check_adopted(&self, app: &mut App, candidate_address: *const CompiledSourceProject) {
-        assert!(
-            std::ptr::eq(app.document.compiled(), candidate_address),
-            "adopt exact candidate allocation"
-        );
-        assert_eq!(app.project(), &self.expected_project);
-        assert_eq!(app.document.bundle(), &self.expected_bundle);
-        assert_eq!(app.source_workspace.bundle(), self.expected_bundle);
-        assert_eq!(app.source_editor.text(), self.expected_bundle.files[ORIGIN]);
-        assert_eq!(app.document.revision(), 1);
-        assert!(app.document.dirty() && app.document.can_undo() && !app.document.can_redo());
-        assert!(app.document.undo());
-        assert_eq!(app.project(), &self.project);
-        assert_eq!(app.document.bundle(), &self.bundle);
-        assert!(
-            !app.document.dirty(),
-            "live known saved baseline remains authoritative"
-        );
-        assert!(
-            !app.document.can_undo(),
-            "exactly one preceding model transaction"
-        );
-        assert!(app.document.redo());
-        assert_eq!(app.project(), &self.expected_project);
-        assert_eq!(app.document.bundle(), &self.expected_bundle);
-        assert!(std::ptr::eq(app.document.compiled(), candidate_address));
-    }
-}
-
-#[derive(Default)]
-struct Samples(BTreeMap<&'static str, Vec<Duration>>);
-
-impl Samples {
-    fn time<T>(&mut self, phase: &'static str, trial: usize, action: impl FnOnce() -> T) -> T {
-        let started = Instant::now();
-        let result = action();
-        let elapsed = started.elapsed();
-        // Printing, assertions and dropping the returned value are outside this
-        // interval. Full Confirm still includes production's own local drops.
-        println!(
-            "{}",
-            serde_json::json!({
-                "record": "timing", "phase": phase, "trial": trial,
-                "warmup": trial == 0, "elapsed_ns": elapsed.as_nanos().to_string(),
-                "elapsed_ms": elapsed.as_secs_f64() * 1000.0
-            })
-        );
-        if trial != 0 {
-            self.0.entry(phase).or_default().push(elapsed);
-        }
-        result
-    }
-
-    fn report(mut self) {
-        for (phase, values) in &mut self.0 {
-            assert_eq!(values.len(), 5);
-            values.sort();
-            println!(
-                "{}",
-                serde_json::json!({
-                    "record": "summary", "phase": phase, "samples": values.len(),
-                    "min_ms": values[0].as_secs_f64() * 1000.0,
-                    "median_ms": values[2].as_secs_f64() * 1000.0,
-                    "max_ms": values[4].as_secs_f64() * 1000.0
-                })
-            );
-        }
-    }
-}
-
-fn resolve(app: &App, context: &Context) -> Target {
-    let snapshot = app
-        .with_source_input(|input| query::admit_owned(input, query::Limits::default()))
-        .unwrap()
-        .capture()
-        .unwrap();
-    let offset = nav::cursor_offset(app.source_workspace.text(), context.begin.cursor).unwrap();
-    resolve_target(&snapshot, context, offset).unwrap()
-}
-
-fn active_job(app: &App) -> Job {
-    let form = app.source_rename.form.as_ref().unwrap();
-    let id = form.pending.unwrap();
-    assert_eq!(app.source_rename.in_flight, Some(id));
-    Job {
-        id,
-        invocation: form.invocation,
-        generation: form.generation,
-        context: form.context.clone(),
-    }
-}
-
-fn separate_phases(fixture: &Fixture, samples: &mut Samples, trial: usize) {
-    let mut app = fixture.app();
-    let target = resolve(&app, &app.rename_context());
-    assert_eq!(target.id, fixture.target);
-    let request = samples
-        .time("document_request_mint", trial, || {
-            app.document.alias_rename_request(target.id, NEW.into())
-        })
-        .unwrap();
-    let prepared = samples
-        .time("worker_document_prepare", trial, || request.prepare())
-        .unwrap();
-    fixture.check_candidate(&prepared);
-    let approval = samples
-        .time("worker_preview_and_origin", trial, || {
-            prepare_approval(prepared, &target, ORIGIN)
-        })
-        .unwrap();
-    assert_eq!(approval.preview.files().len(), 2);
-    assert_eq!(approval.preview.changed_line_count(), 6);
-    let candidate_address = approval.prepared.after() as *const CompiledSourceProject;
-    // Same-destination save completion is a legitimate live update after Preview.
-    app.document.mark_saved(app.document.snapshot());
-    let changed = samples
-        .time("document_guarded_commit", trial, || {
-            app.document.commit_alias_rename(&approval.prepared)
-        })
-        .unwrap();
-    assert!(changed);
-    samples.time("app_sync", trial, || app.sync());
-    fixture.check_adopted(&mut app, candidate_address);
-}
-
-fn whole_confirm(fixture: &Fixture, samples: &mut Samples, trial: usize) {
-    let mut app = fixture.app();
-    let begin = app.source_rename_message();
-    // These Tasks are deliberately not polled: deterministic worker helpers
-    // supply the same results through the real readiness messages below.
-    drop(app.update(begin));
-    let target_job = active_job(&app);
-    let target = Arc::new(resolve(&app, &target_job.context));
-    assert_eq!(target.id, fixture.target);
-    drop(app.update(Message::SourceRenameReady(Completion {
-        job: target_job,
-        payload: Payload::Target(Ok(target.clone())),
-    })));
-    let invocation = app.source_rename.form.as_ref().unwrap().invocation;
-    drop(app.update(Message::SourceRename(Event::Input(invocation, NEW.into()))));
-    let generation = app.source_rename.form.as_ref().unwrap().generation;
-    drop(app.update(Message::SourceRename(Event::Preview(
-        invocation, generation,
-    ))));
-    let preview_job = active_job(&app);
-    let prepared = app
-        .document
-        .alias_rename_request(target.id, NEW.into())
-        .unwrap()
-        .prepare()
-        .unwrap();
-    fixture.check_candidate(&prepared);
-    let approval = Arc::new(prepare_approval(prepared, &target, ORIGIN).unwrap());
-    drop(target);
-    let candidate_address = approval.prepared.after() as *const CompiledSourceProject;
-    let expected_cursor = approval.cursor;
-    let approval_id = approval.id;
-    drop(app.update(Message::SourceRenameReady(Completion {
-        job: preview_job,
-        payload: Payload::Preview(Ok(approval)),
-    })));
-    assert_eq!(
-        app.source_rename
-            .form
-            .as_ref()
-            .unwrap()
-            .approval
-            .as_ref()
-            .unwrap()
-            .id,
-        approval_id
-    );
-    app.document.mark_saved(app.document.snapshot());
-    let confirm = Message::SourceRename(Event::Confirm(invocation, generation, approval_id));
-    let task = samples.time("app_confirm_update", trial, || app.update(confirm));
-    samples.time("confirm_returned_task_drop_without_polling", trial, || {
-        drop(task)
-    });
-    assert!(!app.source_rename.open());
-    assert!(app.source_rename.in_flight.is_none());
-    assert!(app.source_rename_undo_message().is_some());
-    assert_eq!(app.source_editor.cursor(), expected_cursor);
-    fixture.check_adopted(&mut app, candidate_address);
-}
-
-#[test]
-#[ignore = "manual Windows dev/debug rename latency trial; run alone with --ignored --nocapture --test-threads=1"]
-fn accepted_release1_prepare_commit_sync_and_confirm_timing() {
-    let fixture = Fixture::load();
-    let mut samples = Samples::default();
-    for trial in 0..=5 {
-        println!(
-            "{}",
-            serde_json::json!({ "record": "order", "trial": trial,
-            "warmup": trial == 0, "separate_phases_first": trial % 2 == 0 })
-        );
-        if trial % 2 == 0 {
-            separate_phases(&fixture, &mut samples, trial);
-            whole_confirm(&fixture, &mut samples, trial);
-        } else {
-            whole_confirm(&fixture, &mut samples, trial);
-            separate_phases(&fixture, &mut samples, trial);
-        }
-    }
-    samples.report();
-}

crates/oa-desktop/src/app/source_symbols.rs

@@ -1,521 +0,0 @@
-//! Current draft navigation, isolated from model application and disk discovery.
-use super::*;
-use crate::source_navigation::{self as nav, query};
-use std::sync::atomic::Ordering;
-
-fn admission_notice(error: query::AdmissionError) -> String {
-    use nav::symbols::{BuildError, InputProblem, Resource};
-    let (limit, resource) = match error {
-        query::AdmissionError::Index(BuildError::Limit { limit, resource, .. }) => (limit, resource),
-        query::AdmissionError::Outline { error, .. } => (error.limit, match error.resource {
-            language::OutlineResource::SourceBytes => Resource::SourceBytes,
-            language::OutlineResource::Tokens => Resource::Tokens,
-            language::OutlineResource::Declarations => Resource::Records,
-        }),
-        query::AdmissionError::Index(BuildError::Input { problem, .. }) => return match problem {
-            InputProblem::NonCanonicalPath | InputProblem::DuplicateOrCaseCollidingPath =>
-                "Navigation needs distinct relative source paths. Check file names and include paths.".into(),
-            _ => "Navigation could not verify the current source locations. Correct source errors and try again.".into(),
-        },
-    };
-    let unit = match resource {
-        Resource::Files => "loaded files",
-        Resource::SourceBytes => "source bytes",
-        Resource::PathBytes => "bytes in file paths",
-        Resource::Tokens => "source tokens",
-        Resource::Records => "declarations and references",
-    };
-    format!(
-        "Navigation reached its limit of {limit} {unit}. Reduce the loaded source size and try again."
-    )
-}
-
-impl App {
-    pub fn source_symbol_context(&self) -> nav::SymbolContext {
-        nav::SymbolContext {
-            session: self.source_workspace.session(),
-            path: self.source_workspace.active.clone(),
-        }
-    }
-
-    pub fn source_symbol_message(&self, event: nav::SymbolEvent) -> Message {
-        Message::SourceSymbols(self.source_symbol_context(), event)
-    }
-
-    pub fn source_find_close_message(&self) -> Message {
-        Message::SourceFindClose(self.source_symbol_context(), self.source_find_instance)
-    }
-    pub fn source_key(&self) -> query::SnapshotKey {
-        query::SnapshotKey {
-            workspace: self.source_workspace.session(),
-            revision: self.source_workspace.revision(),
-        }
-    }
-
-    pub(super) fn with_source_input<T>(&self, use_input: impl FnOnce(query::Input<'_>) -> T) -> T {
-        let files: Vec<_> = self
-            .source_workspace
-            .files
-            .iter()
-            .map(|(path, buffer)| query::DraftFile {
-                path,
-                text: &buffer.text,
-            })
-            .collect();
-        let accepted = self.document.bundle();
-        let validated: Vec<_> = accepted
-            .files
-            .iter()
-            .map(|(path, text)| query::DraftFile { path, text })
-            .collect();
-        use_input(query::Input {
-            key: self.source_key(),
-            entry: &self.source_workspace.entry,
-            files: &files,
-            applied: self.source_workspace.applied,
-            validation: self
-                .source_workspace
-                .applied
-                .then_some(query::ValidatedSources {
-                    entry: &accepted.entry,
-                    files: &validated,
-                }),
-        })
-    }
-
-    pub(super) fn source_snapshot_matches(&self, snapshot: &query::Snapshot) -> bool {
-        snapshot.key() == self.source_key()
-            && self.with_source_input(|input| snapshot.matches(input))
-    }
-
-    pub fn source_navigation_available(&self) -> bool {
-        self.page == Page::Text
-            && !self.source_rename.open()
-            && !self.busy
-            && self.pending.is_none()
-            && self.file_prompt.is_none()
-            && !self.delete_pending
-            && self.workflow.is_none()
-            && !self.hosted.visible
-            && self.model_menu.is_none()
-            && self.text_workspace.menu().is_none()
-            && self.architecture.is_none()
-            && !self.behavior.has_pending()
-    }
-
-    /// Mounted widget IDs change when another interaction supersedes a reveal.
-    /// A queued focus operation therefore cannot find a subsequently reused editor.
-    pub fn source_editor_id(&self) -> iced::widget::Id {
-        iced::widget::Id::from(format!(
-            "source-editor-{}-{}-{}",
-            self.source_workspace.session(),
-            self.source_workspace.active,
-            self.source_symbols.interaction
-        ))
-    }
-
-    /// The reviewed diagram-query union is not integrated into this source yet.
-    /// Its eventual adapter must return the peer's captured chooser message.
-    pub(super) fn text_diagram_usages_message(&self) -> Option<Message> {
-        None
-    }
-
-    pub fn source_reveal_ticket(&self) -> Option<Id> {
-        self.source_symbols
-            .reveal
-            .as_ref()
-            .map(|reveal| reveal.ticket)
-    }
-
-    pub(super) fn source_interaction(&mut self) {
-        self.source_symbols.interaction = Id::new_v4();
-        self.source_symbols.request = None;
-        self.source_symbols.reveal = None;
-        self.source_jump = None;
-    }
-
-    pub(super) fn queue_source_reveal(&mut self, cursor: text_editor::Cursor, select_line: bool) {
-        self.source_jump = Some(cursor);
-        self.source_select_line = select_line;
-        self.source_symbols.reveal = Some(nav::Reveal {
-            ticket: Id::new_v4(),
-            interaction: self.source_symbols.interaction,
-            raw_interaction: self.source_symbols.raw_interaction.load(Ordering::SeqCst),
-            snapshot: self.source_key(),
-            path: self.source_workspace.active.clone(),
-        });
-    }
-
-    pub(super) fn restore_source_editor_focus(&mut self) {
-        let cursor = self.source_editor.cursor();
-        if self.source_navigation_available()
-            && nav::exact_cursor(self.source_workspace.text(), cursor)
-        {
-            self.queue_source_reveal(cursor, false);
-            // This ticket restores focus to the live editor, not a saved cursor.
-            // Iced's Cursor omits Word/Line selection kind; moving back to that
-            // lossy value would collapse an actual word/line selection.
-            self.source_jump = None;
-        }
-    }
-
-    pub(super) fn source_viewport(&mut self, ticket: Option<Id>) -> Task<Message> {
-        let Some(reveal) = &self.source_symbols.reveal else {
-            return Task::none();
-        };
-        if Some(reveal.ticket) != ticket
-            || reveal.interaction != self.source_symbols.interaction
-            || !nav::interaction::is_current(
-                &self.source_symbols.raw_interaction,
-                reveal.raw_interaction,
-            )
-            || reveal.snapshot != self.source_key()
-            || reveal.path != self.source_workspace.active
-            || !self.source_navigation_available()
-        {
-            return Task::none();
-        }
-        let raw_interaction = reveal.raw_interaction;
-        self.source_symbols.reveal = None;
-        if let Some(cursor) = self.source_jump.take() {
-            if !nav::exact_cursor(self.source_workspace.text(), cursor) {
-                return Task::none();
-            }
-            self.source_editor.move_to(cursor);
-            if self.source_select_line && cursor.selection.is_none() {
-                self.source_editor.perform(text_editor::Action::SelectLine);
-            }
-        }
-        // A valid ticket with no jump is focus-only. All intentional navigation
-        // still takes the cursor branch above, including explicit line selection.
-        nav::interaction::guarded_focus(
-            self.source_editor_id(),
-            self.source_symbols.raw_interaction.clone(),
-            raw_interaction,
-        )
-    }
-
-    pub(super) fn source_symbol_event(&mut self, event: nav::SymbolEvent) -> Task<Message> {
-        if !self.source_navigation_available() {
-            return Task::none();
-        }
-        match event {
-            nav::SymbolEvent::Close => {
-                return self.show_text_drawer(None);
-            }
-            nav::SymbolEvent::Back => {
-                self.source_symbol_back();
-                // A successful Back needs no empty results panel. Retain an
-                // already open panel, or reveal an actionable return notice.
-                if self.source_symbols.notice.is_some() {
-                    self.text_workspace
-                        .show_drawer(Some(text_workspace::DrawerTab::References));
-                    let refs = self.text_workspace.references();
-                    return iced::widget::operation::scroll_to(
-                        self.text_workspace.reference_scroll_id(),
-                        iced::widget::scrollable::AbsoluteOffset {
-                            x: 0.,
-                            y: refs.scroll_y(),
-                        },
-                    );
-                }
-            }
-            nav::SymbolEvent::Choose {
-                stamp,
-                reference,
-                index,
-                ..
-            } => {
-                let Some(results) = self.source_symbols.results.clone() else {
-                    return Task::none();
-                };
-                if results.stamp != stamp
-                    || stamp.snapshot != self.source_key()
-                    || self
-                        .source_symbols
-                        .cache
-                        .as_ref()
-                        .is_none_or(|cache| !self.source_snapshot_matches(cache))
-                {
-                    self.source_symbols.notice =
-                        Some("Source changed. Run navigation again for current locations.".into());
-                    return Task::none();
-                }
-                let destination = if reference {
-                    results
-                        .references
-                        .get(index)
-                        .map(|row| (&row.path, row.position, row.end_position))
-                } else {
-                    results
-                        .definitions
-                        .get(index)
-                        .map(|row| (&row.path, row.position, row.end_position))
-                };
-                if let Some((path, start, end)) = destination {
-                    self.source_symbol_jump(path, start, end);
-                }
-            }
-            nav::SymbolEvent::Query(action) => return self.start_source_query(action),
-        }
-        Task::none()
-    }
-
-    fn start_source_query(&mut self, action: query::Action) -> Task<Message> {
-        self.text_workspace
-            .show_drawer(Some(text_workspace::DrawerTab::References));
-        if !nav::interaction::is_current(
-            &self.source_symbols.raw_interaction,
-            self.source_symbols.raw_interaction.load(Ordering::SeqCst),
-        ) {
-            self.source_symbols.notice = Some("Reopen this workspace to reset navigation.".into());
-            return Task::none();
-        }
-        if self.source_symbols.in_flight.is_some() {
-            self.source_symbols.notice = Some("Navigation is finishing. Try again shortly.".into());
-            return Task::none();
-        }
-        let cursor = self.source_editor.cursor();
-        let Some(offset) = nav::cursor_offset(self.source_workspace.text(), cursor) else {
-            self.source_symbols.notice =
-                Some("Place the cursor on an alias or its @ reference.".into());
-            return Task::none();
-        };
-        self.source_symbols.serial = match self.source_symbols.serial.checked_add(1) {
-            Some(serial) => serial,
-            None => {
-                self.reset_source_navigation_session();
-                self.source_symbols.back.clear();
-                self.source_symbols.cache = None;
-                0
-            }
-        };
-        let request = nav::Request {
-            job: Id::new_v4(),
-            interaction: self.source_symbols.interaction,
-            raw_interaction: self.source_symbols.raw_interaction.load(Ordering::SeqCst),
-            stamp: query::QueryStamp {
-                snapshot: self.source_key(),
-                serial: self.source_symbols.serial,
-            },
-            path: self.source_workspace.active.clone(),
-            offset,
-            cursor,
-            action,
-        };
-        let cache = self
-            .source_symbols
-            .cache
-            .as_ref()
-            .filter(|cache| self.source_snapshot_matches(cache))
-            .cloned();
-        let input = if cache.is_none() {
-            match self
-                .with_source_input(|input| query::admit_owned(input, query::Limits::default()))
-            {
-                Ok(input) => Some(input),
-                Err(error) => {
-                    self.source_symbols.notice = Some(admission_notice(error));
-                    return Task::none();
-                }
-            }
-        } else {
-            None
-        };
-        self.source_symbols.in_flight = Some(request.job);
-        self.source_symbols.request = Some(request.clone());
-        self.source_symbols.display_request = Some(request.clone());
-        self.text_workspace
-            .begin_references(request.stamp, request.path.clone());
-        self.source_symbols.results = None;
-        self.source_symbols.notice = None;
-        let worker = Task::perform(
-            async move {
-                let worker_request = request.clone();
-                let result = tokio::task::spawn_blocking(move || {
-                    let snapshot = match cache {
-                        Some(cache) => cache,
-                        None => Arc::new(
-                            input
-                                .expect("admitted input for uncached request")
-                                .capture()
-                                .map_err(admission_notice)?,
-                        ),
-                    };
-                    let results = snapshot
-                        .query(query::Query {
-                            stamp: worker_request.stamp,
-                            path: &worker_request.path,
-                            byte_offset: worker_request.offset,
-                            action: worker_request.action,
-                        })
-                        .map_err(|error| match error {
-                            query::QueryError::ResultEnvelopeLimit => "These result details exceed the display limit. Try literal Find for this alias.".to_owned(),
-                            _ => "Navigation could not verify this location. Place the cursor on an alias and try again.".to_owned(),
-                        })?;
-                    Ok((snapshot, Arc::new(results)))
-                })
-                .await
-                .unwrap_or_else(|error| Err(format!("Navigation task failed: {error}")));
-                nav::Completion { request, result }
-            },
-            Message::SourceSymbolsReady,
-        );
-        Task::batch([
-            worker,
-            iced::widget::operation::scroll_to(
-                self.text_workspace.reference_scroll_id(),
-                iced::widget::scrollable::AbsoluteOffset { x: 0., y: 0. },
-            ),
-        ])
-    }
-
-    pub(super) fn source_symbols_ready(&mut self, completion: nav::Completion) -> Task<Message> {
-        let request = completion.request;
-        if self.source_symbols.in_flight != Some(request.job) {
-            return Task::none();
-        }
-        self.source_symbols.in_flight = None;
-        let wanted_navigation = self
-            .source_symbols
-            .request
-            .take()
-            .is_some_and(|current| current == request)
-            && request.interaction == self.source_symbols.interaction
-            && request.stamp.snapshot == self.source_key()
-            && nav::interaction::is_current(
-                &self.source_symbols.raw_interaction,
-                request.raw_interaction,
-            )
-            && request.path == self.source_workspace.active
-            && request.cursor == self.source_editor.cursor()
-            && self.source_navigation_available();
-        let wanted_display = self
-            .source_symbols
-            .display_request
-            .as_ref()
-            .is_some_and(|current| current == &request)
-            && request.stamp.snapshot == self.source_key();
-        if !wanted_display {
-            return Task::none();
-        }
-        match completion.result {
-            Ok((snapshot, results))
-                if self.source_snapshot_matches(&snapshot)
-                    && results.stamp == request.stamp
-                    && results.action == request.action =>
-            {
-                self.source_symbols.cache = Some(snapshot);
-                self.source_symbols.results = Some(results.clone());
-                self.text_workspace.install_reference_files(
-                    results.stamp,
-                    results
-                        .definitions
-                        .iter()
-                        .map(|row| row.path.clone())
-                        .chain(results.references.iter().map(|row| row.path.clone())),
-                );
-                if wanted_navigation
-                    && results.disposition == query::Disposition::Direct
-                    && let Some(row) = results.definitions.first()
-                {
-                    self.source_symbol_jump(&row.path, row.position, row.end_position);
-                }
-            }
-            Ok(_) => {
-                self.source_symbols.notice = Some("Source changed. Run navigation again.".into())
-            }
-            Err(error) => self.source_symbols.notice = Some(error),
-        }
-        Task::none()
-    }
-
-    fn source_symbol_jump(&mut self, path: &str, start: query::Position, end: query::Position) {
-        let cursor = text_editor::Cursor {
-            position: text_editor::Position {
-                line: start.line,
-                column: start.byte_column,
-            },
-            selection: Some(text_editor::Position {
-                line: end.line,
-                column: end.byte_column,
-            }),
-        };
-        if self
-            .source_workspace
-            .files
-            .get(path)
-            .is_none_or(|buffer| !nav::exact_cursor(&buffer.text, cursor))
-        {
-            self.source_symbols.notice =
-                Some("That source location is no longer available. Run navigation again.".into());
-            return;
-        }
-        // The destination is admitted. Capture effective Word/Line ranges only
-        // now, when this editor is actually about to leave its current position.
-        let departure = nav::selection::capture(&mut self.source_editor);
-        if let Some(buffer) = self
-            .source_workspace
-            .files
-            .get(&self.source_workspace.active)
-        {
-            let origin = nav::HistoryEntry {
-                session: self.source_workspace.session(),
-                path: self.source_workspace.active.clone(),
-                generation: buffer.generation(),
-                cursor: departure,
-            };
-            self.source_symbols
-                .back
-                .retain(|entry| entry.session == origin.session);
-            if self.source_symbols.back.len() == 64 {
-                self.source_symbols.back.remove(0);
-            }
-            self.source_symbols.back.push(origin);
-        }
-        self.source_workspace.switch(path, departure);
-        self.show_source_file(false);
-        self.queue_source_reveal(cursor, false);
-    }
-
-    fn source_symbol_back(&mut self) {
-        while let Some(origin) = self.source_symbols.back.pop() {
-            if origin.session != self.source_workspace.session() {
-                continue;
-            }
-            let Some(buffer) = self.source_workspace.files.get(&origin.path) else {
-                self.source_symbols.notice = Some("The previous file is no longer loaded.".into());
-                return;
-            };
-            let unchanged = origin.generation == buffer.generation();
-            let mut cursor = if unchanged {
-                origin.cursor
-            } else if origin.path == self.source_workspace.active {
-                self.source_editor.cursor()
-            } else {
-                buffer.cursor
-            };
-            if !nav::exact_cursor(&buffer.text, cursor) {
-                self.source_symbols.notice = Some(
-                    "The previous location changed. Open the file to choose a current position."
-                        .into(),
-                );
-                return;
-            }
-            let departure = nav::selection::capture(&mut self.source_editor);
-            if !unchanged && origin.path == self.source_workspace.active {
-                cursor = departure;
-            }
-            self.source_workspace.switch(&origin.path, departure);
-            self.show_source_file(false);
-            self.queue_source_reveal(cursor, false);
-            self.source_symbols.notice =
-                (!unchanged).then(|| "This draft changed; its current cursor was restored.".into());
-            return;
-        }
-        self.source_symbols.notice = Some("No previous source location in this workspace.".into());
-    }
-}
-
-#[cfg(test)]
-mod tests;

crates/oa-desktop/src/app/text_workspace.rs

@@ -1,646 +0,0 @@
-//! Text-only presentation and captured command envelopes. Source/model authority
-//! remains in the existing App controllers; dispatch this envelope before the
-//! generic source_interaction invalidation in App::update.
-use super::{App, Message};
-use crate::{context_menu, source_navigation as nav};
-use iced::{
-    Point, Task,
-    widget::{self, text_editor::Cursor},
-};
-use nav::query::{QueryStamp, SnapshotKey};
-use oa_core::{Id, source_project::SourceLocation};
-use std::collections::BTreeSet;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum DrawerTab {
-    References,
-    Problems,
-    Status,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum Command {
-    Find,
-    GoToLine,
-    Definition,
-    References,
-    RenameAlias,
-    Back,
-    UndoText,
-    RedoText,
-    UndoModel,
-    RedoModel,
-    UndoRename,
-    RevertFile,
-    ShowProblems,
-    ShowStatus,
-    ShowDiagramUsages,
-}
-impl Command {
-    fn shortcut(self) -> Option<&'static str> {
-        match self {
-            Self::Find => Some("Ctrl F"),
-            Self::GoToLine => Some("Ctrl G"),
-            Self::Definition => Some("F12"),
-            Self::References => Some("Shift F12"),
-            Self::RenameAlias => Some("F2"),
-            Self::Back => Some("Alt ←"),
-            Self::UndoText => Some("Ctrl Z"),
-            Self::RedoText => Some("Ctrl Y"),
-            _ => None,
-        }
-    }
-    fn label(self) -> &'static str {
-        match self {
-            Self::Find => "Find in file",
-            Self::GoToLine => "Go to line",
-            Self::Definition => "Go to definition",
-            Self::References => "Find references",
-            Self::RenameAlias => "Rename source alias",
-            Self::Back => "Back in source",
-            Self::UndoText => "Undo text edit",
-            Self::RedoText => "Redo text edit",
-            Self::UndoModel => "Undo model change",
-            Self::RedoModel => "Redo model change",
-            Self::UndoRename => "Undo source rename",
-            Self::RevertFile => "Revert current file",
-            Self::ShowProblems => "Source problems",
-            Self::ShowStatus => "Source status",
-            Self::ShowDiagramUsages => "Show diagram usages",
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct CommandContext {
-    document: Id,
-    document_revision: u64,
-    source: SnapshotKey,
-    path: String,
-    cursor: Cursor,
-    interaction: Id,
-}
-#[derive(Debug, Clone)]
-pub struct CommandRequest {
-    context: CommandContext,
-    command: Command,
-}
-#[derive(Debug, Clone)]
-pub struct MenuRequest {
-    context: CommandContext,
-    anchor: Point,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct DiagnosticPublication {
-    generation: Id,
-    source: SnapshotKey,
-}
-impl DiagnosticPublication {
-    pub fn generation(self) -> Id {
-        self.generation
-    }
-    pub fn source(self) -> SnapshotKey {
-        self.source
-    }
-    pub fn target(self, visit: Id, location: SourceLocation) -> DiagnosticTarget {
-        DiagnosticTarget {
-            publication: self,
-            visit,
-            location,
-        }
-    }
-}
-#[derive(Debug, Clone)]
-pub struct DiagnosticTarget {
-    publication: DiagnosticPublication,
-    visit: Id,
-    location: SourceLocation,
-}
-
-#[derive(Debug, Clone)]
-pub enum Event {
-    ShowDrawer(DrawerTab),
-    HideDrawer,
-    ResizeDrawer(f32),
-    ToggleFile {
-        stamp: QueryStamp,
-        visit: Id,
-        path: String,
-    },
-    ReferenceScrolled {
-        stamp: QueryStamp,
-        visit: Id,
-        y: f32,
-    },
-    Command(CommandRequest),
-    OpenMenu(MenuRequest),
-    DismissMenu(Id),
-    Invoke {
-        token: Id,
-        command: Command,
-    },
-    Diagnostic(DiagnosticTarget),
-}
-
-#[derive(Debug, Clone)]
-struct FrozenEntry {
-    command: Command,
-    action: Option<Action>,
-}
-#[derive(Debug, Clone)]
-enum Action {
-    Dispatch(Box<Message>),
-    Drawer(DrawerTab),
-}
-#[derive(Debug, Clone)]
-pub struct Menu {
-    token: Id,
-    popup_token: u64,
-    anchor: Point,
-    context: CommandContext,
-    entries: Vec<FrozenEntry>,
-}
-impl Menu {
-    pub fn token(&self) -> Id {
-        self.token
-    }
-}
-
-#[derive(Debug)]
-pub struct ReferencePresentation {
-    stamp: Option<QueryStamp>,
-    origin: String,
-    files: BTreeSet<String>,
-    installed: bool,
-    collapsed_files: BTreeSet<String>,
-    scroll_y: f32,
-}
-impl Default for ReferencePresentation {
-    fn default() -> Self {
-        Self {
-            stamp: None,
-            origin: String::new(),
-            files: BTreeSet::new(),
-            installed: false,
-            collapsed_files: BTreeSet::new(),
-            scroll_y: 0.,
-        }
-    }
-}
-impl ReferencePresentation {
-    pub fn stamp(&self) -> Option<QueryStamp> {
-        self.stamp
-    }
-    pub fn scroll_y(&self) -> f32 {
-        self.scroll_y
-    }
-    pub fn collapsed(&self, path: &str) -> bool {
-        self.collapsed_files.contains(path)
-    }
-}
-
-#[derive(Debug)]
-pub struct State {
-    drawer: Option<DrawerTab>,
-    drawer_visit: Id,
-    drawer_height: f32,
-    references: ReferencePresentation,
-    menu: Option<Menu>,
-    diagnostic_publication: Option<DiagnosticPublication>,
-}
-impl Default for State {
-    fn default() -> Self {
-        Self {
-            drawer: None,
-            drawer_visit: Id::new_v4(),
-            drawer_height: 180.,
-            references: ReferencePresentation::default(),
-            menu: None,
-            diagnostic_publication: None,
-        }
-    }
-}
-impl State {
-    pub fn drawer_visit(&self) -> Id {
-        self.drawer_visit
-    }
-    pub fn reference_scroll_id(&self) -> widget::Id {
-        widget::Id::from(format!("text-references-{}", self.drawer_visit))
-    }
-    pub fn drawer(&self) -> Option<DrawerTab> {
-        self.drawer
-    }
-    pub fn drawer_height(&self) -> f32 {
-        self.drawer_height
-    }
-    pub fn references(&self) -> &ReferencePresentation {
-        &self.references
-    }
-    pub fn menu(&self) -> Option<&Menu> {
-        self.menu.as_ref()
-    }
-    pub fn diagnostic_publication(&self) -> Option<DiagnosticPublication> {
-        self.diagnostic_publication
-    }
-    /// Call for EVERY diagnostics replacement or clear, including equal bytes.
-    pub fn publish_diagnostics(&mut self, source: SnapshotKey) -> DiagnosticPublication {
-        let publication = DiagnosticPublication {
-            generation: Id::new_v4(),
-            source,
-        };
-        self.diagnostic_publication = Some(publication);
-        publication
-    }
-    pub fn reset(&mut self) {
-        *self = Self::default();
-    }
-    pub fn dismiss_menu(&mut self) {
-        self.menu = None;
-    }
-    pub fn begin_references(&mut self, stamp: QueryStamp, origin: String) {
-        self.references = ReferencePresentation {
-            stamp: Some(stamp),
-            origin,
-            ..ReferencePresentation::default()
-        };
-        self.show_drawer(Some(DrawerTab::References));
-    }
-    /// Install presentation groups only for the current completed query. Repeated
-    /// delivery of the same completion cannot undo the user's group choices.
-    pub fn install_reference_files(
-        &mut self,
-        stamp: QueryStamp,
-        paths: impl IntoIterator<Item = String>,
-    ) {
-        let refs = &mut self.references;
-        if refs.stamp != Some(stamp) || refs.installed {
-            return;
-        }
-        refs.files = paths.into_iter().collect();
-        refs.collapsed_files = refs.files.clone();
-        let expanded = if refs.files.contains(&refs.origin) {
-            Some(refs.origin.clone())
-        } else {
-            refs.files.first().cloned()
-        };
-        if let Some(path) = expanded {
-            refs.collapsed_files.remove(&path);
-        }
-        refs.installed = true;
-    }
-    pub(super) fn show_drawer(&mut self, drawer: Option<DrawerTab>) {
-        self.drawer = drawer;
-        self.drawer_visit = Id::new_v4();
-    }
-    fn toggle_file(&mut self, stamp: QueryStamp, visit: Id, path: String) -> bool {
-        let refs = &mut self.references;
-        if self.drawer != Some(DrawerTab::References)
-            || self.drawer_visit != visit
-            || refs.stamp != Some(stamp)
-            || !refs.files.contains(&path)
-        {
-            return false;
-        }
-        if !refs.collapsed_files.remove(&path) {
-            refs.collapsed_files.insert(path);
-        }
-        // Collapsing a group can replace a pressed row at the same position.
-        self.drawer_visit = Id::new_v4();
-        true
-    }
-    fn reference_scrolled(&mut self, stamp: QueryStamp, visit: Id, y: f32) {
-        let refs = &mut self.references;
-        if self.drawer == Some(DrawerTab::References)
-            && refs.stamp == Some(stamp)
-            && self.drawer_visit == visit
-            && y.is_finite()
-            && y >= 0.
-        {
-            refs.scroll_y = y;
-        }
-    }
-}
-
-impl App {
-    fn text_command_context(&self) -> CommandContext {
-        CommandContext {
-            document: self.canvas_document,
-            document_revision: self.document.revision(),
-            source: self.source_key(),
-            path: self.source_workspace.active.clone(),
-            cursor: self.source_editor.cursor(),
-            interaction: self.source_symbols.interaction,
-        }
-    }
-    pub fn text_command_message(&self, command: Command) -> Message {
-        Message::TextWorkspace(Event::Command(CommandRequest {
-            context: self.text_command_context(),
-            command,
-        }))
-    }
-    pub fn text_menu_message(&self, anchor: Point) -> Message {
-        Message::TextWorkspace(Event::OpenMenu(MenuRequest {
-            context: self.text_command_context(),
-            anchor,
-        }))
-    }
-    pub fn text_workspace_menu(&self) -> Option<context_menu::Menu<Message>> {
-        let menu = self.text_workspace.menu.as_ref()?;
-        Some(context_menu::Menu {
-            token: menu.popup_token,
-            anchor: menu.anchor,
-            entries: menu
-                .entries
-                .iter()
-                .flat_map(|entry| {
-                    let mut rows = Vec::with_capacity(2);
-                    if matches!(entry.command, Command::UndoText | Command::ShowProblems) {
-                        rows.push(context_menu::Entry::separator());
-                    }
-                    rows.push(context_menu::Entry::Action {
-                        label: entry.command.label().into(),
-                        shortcut: entry.command.shortcut().map(str::to_owned),
-                        message: entry.action.as_ref().map(|_| {
-                            Message::TextWorkspace(Event::Invoke {
-                                token: menu.token(),
-                                command: entry.command,
-                            })
-                        }),
-                    });
-                    rows
-                })
-                .collect(),
-            on_close: Message::TextWorkspace(Event::DismissMenu(menu.token())),
-        })
-    }
-    pub fn text_diagnostic_message(&self, location: SourceLocation) -> Option<Message> {
-        let publication = self.text_workspace.diagnostic_publication?;
-        (publication.source == self.source_key()
-            && self.text_workspace.drawer() == Some(DrawerTab::Problems))
-        .then(|| {
-            Message::TextWorkspace(Event::Diagnostic(
-                publication.target(self.text_workspace.drawer_visit(), location),
-            ))
-        })
-    }
-    pub(crate) fn source_annotation_snapshot(
-        &self,
-    ) -> Option<crate::source_annotations::Snapshot<'_>> {
-        let publication = self.text_workspace.diagnostic_publication?;
-        let buffer = self
-            .source_workspace
-            .files
-            .get(&self.source_workspace.active)?;
-        if publication.source != self.source_key() || buffer.text != self.source_snapshot.as_ref() {
-            return None;
-        }
-        Some(crate::source_annotations::Snapshot {
-            publication: publication.generation,
-            source: self.source_snapshot.clone(),
-            path: &self.source_workspace.active,
-            diagnostics: &self.source_diagnostics,
-        })
-    }
-    fn text_command_action(&self, command: Command) -> Option<Action> {
-        // Menu has been taken before dispatch-time admission. This intentionally
-        // uses navigation admission, not rename admission, for Find/text history.
-        if !self.source_navigation_available() {
-            return None;
-        }
-        let message =
-            match command {
-                Command::Find => Message::SourceNavigation(nav::Event::Open(false)),
-                Command::GoToLine => Message::SourceNavigation(nav::Event::Open(true)),
-                Command::Definition => self
-                    .source_symbol_message(nav::SymbolEvent::Query(nav::query::Action::Definition)),
-                Command::References => self
-                    .source_symbol_message(nav::SymbolEvent::Query(nav::query::Action::References)),
-                Command::RenameAlias => {
-                    self.rename_admission().ok()?;
-                    self.source_rename_message()
-                }
-                Command::Back => {
-                    if !self
-                        .source_symbols
-                        .back
-                        .iter()
-                        .any(|entry| entry.session == self.source_workspace.session())
-                    {
-                        return None;
-                    }
-                    self.source_symbol_message(nav::SymbolEvent::Back)
-                }
-                Command::UndoText => Message::SourceUndo,
-                Command::RedoText => Message::SourceRedo,
-                Command::UndoModel | Command::RedoModel => {
-                    if self.source_dirty() || self.draft_dirty() {
-                        return None;
-                    }
-                    if command == Command::UndoModel {
-                        if !self.document.can_undo() {
-                            return None;
-                        }
-                        Message::Undo
-                    } else {
-                        if !self.document.can_redo() {
-                            return None;
-                        }
-                        Message::Redo
-                    }
-                }
-                Command::UndoRename => self.source_rename_undo_message()?,
-                Command::RevertFile => Message::RevertSource,
-                Command::ShowProblems => return Some(Action::Drawer(DrawerTab::Problems)),
-                Command::ShowStatus => return Some(Action::Drawer(DrawerTab::Status)),
-                Command::ShowDiagramUsages => self.text_diagram_usages_message()?,
-            };
-        Some(Action::Dispatch(Box::new(message)))
-    }
-    pub(super) fn text_workspace_event(&mut self, event: Event) -> Task<Message> {
-        match event {
-            Event::OpenMenu(request) => {
-                if request.context != self.text_command_context()
-                    || !self.source_navigation_available()
-                    || self.text_workspace.menu.is_some()
-                    || !request.anchor.x.is_finite()
-                    || !request.anchor.y.is_finite()
-                {
-                    return Task::none();
-                }
-                let Some(popup_token) = self.menu_sequence.checked_add(1) else {
-                    return Task::none();
-                };
-                self.source_interaction();
-                let commands = [
-                    Command::Find,
-                    Command::GoToLine,
-                    Command::Definition,
-                    Command::References,
-                    Command::RenameAlias,
-                    Command::Back,
-                    Command::UndoText,
-                    Command::RedoText,
-                    Command::UndoRename,
-                    Command::UndoModel,
-                    Command::RedoModel,
-                    Command::RevertFile,
-                    Command::ShowProblems,
-                    Command::ShowStatus,
-                    Command::ShowDiagramUsages,
-                ];
-                let entries = commands
-                    .into_iter()
-                    .filter_map(|command| {
-                        let action = self.text_command_action(command);
-                        if command == Command::ShowDiagramUsages && action.is_none() {
-                            None
-                        } else {
-                            Some(FrozenEntry { command, action })
-                        }
-                    })
-                    .collect();
-                self.menu_sequence = popup_token;
-                self.text_workspace.menu = Some(Menu {
-                    token: Id::new_v4(),
-                    popup_token,
-                    anchor: request.anchor,
-                    context: self.text_command_context(),
-                    entries,
-                });
-            }
-            Event::DismissMenu(token) => {
-                if self
-                    .text_workspace
-                    .menu
-                    .as_ref()
-                    .is_some_and(|menu| menu.token == token)
-                {
-                    self.text_workspace.menu = None;
-                    self.source_interaction();
-                }
-            }
-            Event::Invoke { token, command } => {
-                if !self.text_workspace.menu.as_ref().is_some_and(|menu| {
-                    menu.token == token && menu.context == self.text_command_context()
-                }) {
-                    return Task::none();
-                }
-                // Validate before closing; consume this invocation only once.
-                // Never resolve a frozen row against a newly generated menu.
-                let menu = self.text_workspace.menu.take().unwrap();
-                let Some(action) = menu
-                    .entries
-                    .into_iter()
-                    .find(|entry| entry.command == command)
-                    .and_then(|entry| entry.action)
-                else {
-                    return Task::none();
-                };
-                if self.text_command_action(command).is_none() {
-                    return Task::none();
-                }
-                return self.dispatch_text_action(action);
-            }
-            Event::Command(request) => {
-                if request.context != self.text_command_context() {
-                    return Task::none();
-                }
-                if let Some(action) = self.text_command_action(request.command) {
-                    return self.dispatch_text_action(action);
-                }
-            }
-            Event::ShowDrawer(tab) => {
-                if !self.source_navigation_available() {
-                    return Task::none();
-                }
-                return self.show_text_drawer(Some(tab));
-            }
-            Event::HideDrawer => {
-                if !self.source_navigation_available() {
-                    return Task::none();
-                }
-                return self.show_text_drawer(None);
-            }
-            Event::ResizeDrawer(height) => {
-                if self.source_navigation_available() && height.is_finite() {
-                    // The view applies the measured editor-allocation bound.
-                    let height = height.clamp(180., 1200.);
-                    if height != self.text_workspace.drawer_height {
-                        self.source_interaction();
-                        self.text_workspace.drawer_height = height;
-                    }
-                }
-            }
-            Event::ToggleFile { stamp, visit, path } => {
-                if self.source_navigation_available()
-                    && self.text_workspace.toggle_file(stamp, visit, path)
-                {
-                    self.source_interaction();
-                }
-            }
-            Event::ReferenceScrolled { stamp, visit, y } => {
-                // Passive geometry must neither invalidate pending navigation
-                // nor reset the editor identity, even while commands are blocked.
-                self.text_workspace.reference_scrolled(stamp, visit, y);
-            }
-            Event::Diagnostic(target) => {
-                if !self.source_navigation_available()
-                    || self.text_workspace.drawer() != Some(DrawerTab::Problems)
-                    || self.text_workspace.drawer_visit() != target.visit
-                    || self.text_workspace.diagnostic_publication != Some(target.publication)
-                    || target.publication.source != self.source_key()
-                    || !self
-                        .source_workspace
-                        .files
-                        .get(&target.location.path)
-                        .is_some_and(|file| valid_span(&file.text, &target.location))
-                {
-                    return Task::none();
-                }
-                self.source_interaction();
-                self.jump_to_source(target.location);
-            }
-        }
-        Task::none()
-    }
-    fn dispatch_text_action(&mut self, action: Action) -> Task<Message> {
-        match action {
-            Action::Dispatch(message) => self.update(*message),
-            Action::Drawer(tab) => self.show_text_drawer(Some(tab)),
-        }
-    }
-    pub(super) fn show_text_drawer(&mut self, drawer: Option<DrawerTab>) -> Task<Message> {
-        self.source_interaction();
-        self.text_workspace.show_drawer(drawer);
-        if drawer == Some(DrawerTab::References) {
-            let refs = self.text_workspace.references();
-            widget::operation::scroll_to(
-                self.text_workspace.reference_scroll_id(),
-                widget::scrollable::AbsoluteOffset {
-                    x: 0.,
-                    y: refs.scroll_y(),
-                },
-            )
-        } else {
-            Task::none()
-        }
-    }
-}
-
-fn valid_span(text: &str, location: &SourceLocation) -> bool {
-    let span = location.span;
-    span.start <= span.end
-        && span.end <= text.len()
-        && text.is_char_boundary(span.start)
-        && text.is_char_boundary(span.end)
-}
-
-#[cfg(test)]
-mod tests;
-
-#[cfg(test)]
-mod lifecycle_tests;
-
-#[cfg(all(test, debug_assertions))]
-mod focus_selection_tests;

crates/oa-desktop/src/app/text_workspace/focus_selection_tests.rs

@@ -1,480 +0,0 @@
-//! The mounted CPU renderer and App use the same cosmic-text editor engine, but
-//! Iced's Content is parameterized by renderer and cannot be shared between them.
-//! We hit-test the initial click in the laid-out CPU widget, seed that raw caret
-//! in App, and relay the real subsequent SelectWord/SelectLine and editing actions.
-//! App's own Content is never replaced or cursor-normalized after selection. This
-//! tests the actual controller/content boundary without a window or GPU; native
-//! replay remains the check of the complete production renderer/layout path.
-use super::*;
-use crate::app::Page;
-use crate::document::Document;
-use crate::source_workspace::{LIMITS, Workspace};
-use crate::views::source_tests::FontLayout;
-use iced::advanced::{Layout, Shell, layout, widget as core_widget};
-use iced::futures::StreamExt;
-use iced::keyboard::{self, Key, Modifiers};
-use iced::widget::{button, container, row, text_editor, text_input};
-use iced::{Element, Event, Font, Size, mouse};
-use oa_core::{Project, source_project::SourceBundle};
-use std::{collections::BTreeMap, sync::Arc, sync::atomic::Ordering};
-
-const SOURCE: &str = concat!(
-    "// oa_contact tail\r\n",
-    "arcadia 7;\r\n",
-    "project model \"Selection\" id \"9e8f0000-0000-4000-8000-000000000091\" {}\r\n",
-);
-const HOST: Size = Size::new(620., 260.);
-
-fn fixture() -> App {
-    let bundle = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), SOURCE.into())]),
-    };
-    let mut app = App::with_project(Project::empty());
-    app.document = Document::from_bundle(bundle, LIMITS).unwrap();
-    app.source_workspace = Workspace::new(app.document.bundle(), true);
-    app.selected = app.project().id;
-    app.refresh_draft();
-    app.page = Page::Text;
-    app.show_source_file(false);
-    app.publish_source_diagnostics(app.document.compiled().diagnostics.clone());
-    app
-}
-
-fn ui<'a>(
-    app: &App,
-    content: &'a text_editor::Content<FontLayout>,
-) -> Element<'a, Message, iced::Theme, FontLayout> {
-    let find: Element<'a, Message, iced::Theme, FontLayout> = if app.source_navigation.open {
-        row![
-            text_input("Find", "")
-                .id("source-find")
-                .on_input(|s| Message::SourceNavigation(nav::Event::Query(s))),
-            container(button("Close").on_press(app.source_find_close_message()))
-                .id("selection-find-close"),
-        ]
-        .into()
-    } else {
-        widget::Space::new().into()
-    };
-    // Column::push drops zero-height children. Keep both paths mounted even
-    // while Find is hidden, as the production retained-slot layout does.
-    widget::Column::from_vec(vec![
-        container(find)
-            .height(if app.source_navigation.open { 32. } else { 0. })
-            .into(),
-        widget::text_editor(content)
-            .id(app.source_editor_id())
-            .font(Font::MONOSPACE)
-            .size(14)
-            .padding(16)
-            .height(iced::Fill)
-            .on_action(Message::SourceEdit)
-            .into(),
-    ])
-    .width(iced::Fill)
-    .height(iced::Fill)
-    .into()
-}
-
-struct Mounted {
-    content: text_editor::Content<FontLayout>,
-    tree: core_widget::Tree,
-}
-
-// Operations follow widget-provided traversal instead of assuming a fixed
-// relationship between layout nodes, transparent containers and state trees.
-struct Inspection {
-    editor: core_widget::Id,
-    focused: Option<bool>,
-    close_bounds: Option<iced::Rectangle>,
-}
-
-impl core_widget::Operation for Inspection {
-    fn traverse(&mut self, operate: &mut dyn FnMut(&mut dyn core_widget::Operation)) {
-        operate(self);
-    }
-
-    fn focusable(
-        &mut self,
-        id: Option<&core_widget::Id>,
-        _: iced::Rectangle,
-        state: &mut dyn core_widget::operation::Focusable,
-    ) {
-        if id == Some(&self.editor) {
-            assert!(
-                self.focused.replace(state.is_focused()).is_none(),
-                "duplicate editor ID"
-            );
-        }
-    }
-
-    fn container(&mut self, id: Option<&core_widget::Id>, bounds: iced::Rectangle) {
-        if id == Some(&core_widget::Id::new("selection-find-close")) {
-            assert!(
-                self.close_bounds.replace(bounds).is_none(),
-                "duplicate Close target ID"
-            );
-        }
-    }
-}
-
-impl Mounted {
-    fn new() -> Self {
-        Self {
-            content: text_editor::Content::with_text(SOURCE),
-            tree: core_widget::Tree::empty(),
-        }
-    }
-
-    fn events(&mut self, app: &App, events: &[(Event, mouse::Cursor)]) -> Vec<Message> {
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        let mut messages = Vec::new();
-        for (event, cursor) in events {
-            let mut shell = Shell::new(&mut messages);
-            view.as_widget_mut().update(
-                &mut self.tree,
-                event,
-                Layout::new(&node),
-                *cursor,
-                &FontLayout,
-                &mut iced::advanced::clipboard::Null,
-                &mut shell,
-                &iced::Rectangle::with_size(HOST),
-            );
-            if !matches!(event, Event::Mouse(mouse::Event::ButtonReleased(_))) {
-                assert!(
-                    shell.is_event_captured(),
-                    "mounted input must be handled: {event:?}"
-                );
-            }
-        }
-        messages
-    }
-
-    fn operation(&mut self, app: &App, mut op: Box<dyn core_widget::Operation>) {
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        loop {
-            view.as_widget_mut().operate(
-                &mut self.tree,
-                Layout::new(&node),
-                &FontLayout,
-                op.as_mut(),
-            );
-            match op.finish() {
-                core_widget::operation::Outcome::Chain(next) => op = next,
-                core_widget::operation::Outcome::None => break,
-                core_widget::operation::Outcome::Some(()) => panic!("focus does not emit messages"),
-            }
-        }
-    }
-
-    async fn task(&mut self, app: &App, task: Task<Message>) {
-        if let Some(mut actions) = iced_runtime::task::into_stream(task) {
-            while let Some(action) = actions.next().await {
-                let iced_runtime::Action::Widget(op) = action else {
-                    panic!("expected a widget operation")
-                };
-                self.operation(app, op);
-            }
-        }
-    }
-
-    fn inspect(&mut self, app: &App) -> Inspection {
-        let mut inspection = Inspection {
-            editor: app.source_editor_id(),
-            focused: None,
-            close_bounds: None,
-        };
-        let mut view = ui(app, &self.content);
-        self.tree.diff(view.as_widget());
-        let node = view.as_widget_mut().layout(
-            &mut self.tree,
-            &FontLayout,
-            &layout::Limits::new(Size::ZERO, HOST),
-        );
-        view.as_widget_mut().operate(
-            &mut self.tree,
-            Layout::new(&node),
-            &FontLayout,
-            &mut inspection,
-        );
-        inspection
-    }
-
-    fn editor_focused(&mut self, app: &App) -> bool {
-        self.inspect(app)
-            .focused
-            .expect("exactly one editor with the requested ID")
-    }
-
-    fn close_message(&mut self, app: &App, escape: bool) -> Message {
-        if escape {
-            let event = Event::Keyboard(keyboard::Event::KeyPressed {
-                key: Key::Named(keyboard::key::Named::Escape),
-                modified_key: Key::Named(keyboard::key::Named::Escape),
-                physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-                location: keyboard::Location::Standard,
-                modifiers: Modifiers::empty(),
-                text: None,
-                repeat: false,
-            });
-            assert!(
-                self.events(app, &[(event, mouse::Cursor::Unavailable)])
-                    .is_empty()
-            );
-            // The existing subscription tests cover the captured-Escape bridge.
-            // Deliver its App message after this actual input captured the key.
-            Message::Escape
-        } else {
-            let center = self
-                .inspect(app)
-                .close_bounds
-                .expect("the mounted Find Close target exists")
-                .center();
-            let cursor = mouse::Cursor::Available(center);
-            let mut messages = self.events(
-                app,
-                &[
-                    (
-                        Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                        cursor,
-                    ),
-                    (
-                        Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                        cursor,
-                    ),
-                ],
-            );
-            assert_eq!(messages.len(), 1);
-            let close = messages.remove(0);
-            assert!(matches!(close, Message::SourceFindClose(..)));
-            close
-        }
-    }
-
-    fn select(&mut self, app: &mut App, line: bool) {
-        // One mounted update batch avoids delays between Iced's consecutive-click
-        // timestamps; content actions are applied in their emitted order below.
-        let at = mouse::Cursor::Available(Point::new(65., 25.));
-        let events = (0..if line { 3 } else { 2 })
-            .flat_map(|_| {
-                [
-                    (
-                        Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
-                        at,
-                    ),
-                    (
-                        Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
-                        at,
-                    ),
-                ]
-            })
-            .collect::<Vec<_>>();
-        let messages = self.events(app, &events);
-        assert_eq!(messages.len(), if line { 3 } else { 2 });
-        for (index, message) in messages.into_iter().enumerate() {
-            let Message::SourceEdit(action) = message else {
-                panic!("editor action")
-            };
-            if index == 0 {
-                assert!(matches!(action, text_editor::Action::Click(_)));
-                self.content.perform(action);
-                let caret = self.content.cursor();
-                assert_eq!(caret.position.line, 0);
-                assert!(
-                    (4..13).contains(&caret.position.column),
-                    "click must hit inside oa_contact: {caret:?}"
-                );
-                // App's GPU-typed Content has no public layout API. Copy only the
-                // initial hit-tested caret before any Word/Line selection exists.
-                app.source_editor.move_to(caret);
-            } else {
-                assert_eq!(
-                    action,
-                    if index == 1 {
-                        text_editor::Action::SelectWord
-                    } else {
-                        text_editor::Action::SelectLine
-                    }
-                );
-                self.content.perform(action.clone());
-                let _ = app.update(Message::SourceEdit(action));
-            }
-        }
-        assert_eq!(
-            self.content.selection().as_deref(),
-            Some(if line {
-                "// oa_contact tail"
-            } else {
-                "oa_contact"
-            })
-        );
-        assert_eq!(app.source_editor.selection(), self.content.selection());
-        assert!(self.editor_focused(app));
-    }
-
-    fn type_replacement(&mut self, app: &mut App) {
-        let event = Event::Keyboard(keyboard::Event::KeyPressed {
-            key: Key::Character("x".into()),
-            modified_key: Key::Character("x".into()),
-            physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyX),
-            location: keyboard::Location::Standard,
-            modifiers: Modifiers::empty(),
-            text: Some("x".into()),
-            repeat: false,
-        });
-        let messages = self.events(app, &[(event, mouse::Cursor::Unavailable)]);
-        assert_eq!(messages.len(), 1);
-        let Message::SourceEdit(action) = messages.into_iter().next().unwrap() else {
-            panic!("typed edit")
-        };
-        assert_eq!(
-            action,
-            text_editor::Action::Edit(text_editor::Edit::Insert('x'))
-        );
-        self.content.perform(action.clone());
-        let _ = app.update(Message::SourceEdit(action));
-    }
-}
-
-#[tokio::test]
-async fn word_and_line_selection_survive_find_close_and_escape_then_replace_exact_bytes() {
-    for line in [false, true] {
-        for escape in [false, true] {
-            let mut app = fixture();
-            let accepted = app.document.snapshot();
-            let mut mounted = Mounted::new();
-            mounted.select(&mut app, line);
-            let selected = app.source_editor.selection();
-            let cursor = app.source_editor.cursor();
-            // Word/Line selection has coincident raw endpoints. Merely checking
-            // cursor equality after a move_to roundtrip cannot detect the defect.
-            assert_eq!(cursor.selection, Some(cursor.position));
-            let task = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-            mounted.task(&app, task).await;
-            assert!(!mounted.editor_focused(&app));
-            assert_eq!(app.source_editor.selection(), selected);
-            let close = mounted.close_message(&app, escape);
-            let _ = app.update(close);
-            let ticket = app
-                .source_reveal_ticket()
-                .expect("guarded restoration ticket");
-            let task = app.update(Message::SourceViewport(Some(ticket)));
-            mounted.task(&app, task).await;
-            assert!(mounted.editor_focused(&app));
-            assert_eq!(app.source_editor.cursor(), cursor);
-            assert_eq!(
-                app.source_editor.selection(),
-                selected,
-                "selected bytes must survive focus restoration"
-            );
-            assert_eq!(app.source_editor.text(), SOURCE);
-            mounted.type_replacement(&mut app);
-            let expected = SOURCE.replacen(selected.as_deref().unwrap(), "x", 1);
-            assert_eq!(app.source_editor.text(), expected);
-            assert_eq!(app.source_workspace.text(), expected);
-            assert_eq!(mounted.content.text(), expected);
-            assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-            assert!(!app.document.can_undo() && !app.document.can_redo());
-        }
-    }
-}
-
-#[test]
-fn mounted_direct_typing_control_and_old_cursor_roundtrip_discriminate_selection_loss() {
-    for line in [false, true] {
-        for old_roundtrip in [false, true] {
-            let mut app = fixture();
-            let mut mounted = Mounted::new();
-            mounted.select(&mut app, line);
-            let selected = app.source_editor.selection().unwrap();
-            let interior = app.source_editor.cursor();
-            if old_roundtrip {
-                app.source_editor.move_to(interior);
-                assert_ne!(
-                    app.source_editor.selection().as_deref(),
-                    Some(selected.as_str())
-                );
-            }
-            mounted.type_replacement(&mut app);
-            let expected = if old_roundtrip {
-                let mut text = SOURCE.to_owned();
-                text.insert(interior.position.column, 'x');
-                text
-            } else {
-                SOURCE.replacen(&selected, "x", 1)
-            };
-            assert_eq!(app.source_editor.text(), expected);
-            assert_eq!(app.source_workspace.text(), expected);
-            assert_eq!(mounted.content.text(), SOURCE.replacen(&selected, "x", 1));
-        }
-    }
-}
-
-#[tokio::test]
-async fn stale_focus_ticket_and_later_raw_input_cannot_steal_focus_or_change_selected_bytes() {
-    for later_raw_input in [false, true] {
-        let mut app = fixture();
-        let mut mounted = Mounted::new();
-        mounted.select(&mut app, false);
-        let selected = app.source_editor.selection();
-        let open = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-        mounted.task(&app, open).await;
-        let close = app.source_find_close_message();
-        let _ = app.update(close);
-        let ticket = app.source_reveal_ticket().unwrap();
-        let focus = if later_raw_input {
-            app.update(Message::SourceViewport(Some(ticket)))
-        } else {
-            Task::none()
-        };
-        let reopen = app.update(Message::SourceNavigation(nav::Event::Open(false)));
-        mounted.task(&app, reopen).await;
-        if later_raw_input {
-            app.source_symbols
-                .raw_interaction
-                .fetch_add(1, Ordering::SeqCst);
-            mounted.task(&app, focus).await;
-        } else {
-            let stale = app.update(Message::SourceViewport(Some(ticket)));
-            mounted.task(&app, stale).await;
-        }
-        assert!(app.source_navigation.open);
-        assert!(!mounted.editor_focused(&app));
-        assert_eq!(app.source_editor.selection(), selected);
-        assert_eq!(app.source_editor.text(), SOURCE);
-    }
-}
-
-#[tokio::test]
-async fn explicit_cursor_navigation_still_moves_and_selects_requested_line() {
-    let mut app = fixture();
-    let mut mounted = Mounted::new();
-    mounted.select(&mut app, false);
-    let target = text_editor::Cursor {
-        position: text_editor::Position { line: 1, column: 3 },
-        selection: None,
-    };
-    // Clear the previous semantic selection as actual show_source_file does when
-    // moving to another source buffer, then exercise intentional navigation.
-    app.show_source_file(false);
-    app.queue_source_reveal(target, true);
-    let ticket = app.source_reveal_ticket().unwrap();
-    let task = app.update(Message::SourceViewport(Some(ticket)));
-    mounted.task(&app, task).await;
-    assert_eq!(app.source_editor.cursor().position, target.position);
-    assert_eq!(app.source_editor.selection().as_deref(), Some("arcadia 7;"));
-}

crates/oa-desktop/src/app/text_workspace/lifecycle_tests.rs

@@ -1,438 +0,0 @@
-//! Real lifecycle receipts, with all disk writes confined to unique temp roots.
-//! Returned App worker tasks are not polled; completions use the normal captured
-//! query input and are delivered deterministically through App::update.
-use super::*;
-use crate::app::{Page, read_snapshot, write_snapshot};
-use crate::document::Document;
-use crate::source_workspace::{LIMITS, Workspace};
-use oa_core::{
-    Project,
-    language::{Diagnostic, Span},
-    source_project::{SourceBundle, SourceDiagnostic},
-    validation::Severity,
-};
-use std::{collections::BTreeMap, path::Path, sync::Arc};
-
-const VALID: &str = concat!(
-    "arcadia 7;\r\n",
-    "project model \"Lifecycle 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n",
-    "    oa_activity assess \"Assess\" id \"9e8f0000-0000-4000-8000-000000000002\" {}\r\n",
-    "}\r\n",
-);
-
-fn fixture() -> App {
-    let bundle = SourceBundle {
-        entry: "project.arcadia".into(),
-        files: BTreeMap::from([("project.arcadia".into(), VALID.into())]),
-    };
-    let mut app = App::with_project(Project::empty());
-    // with_project uses in-memory Home metadata and no recovery directory.
-    assert!(app.recovery.directory.is_none());
-    app.document = Document::from_bundle(bundle, LIMITS).unwrap();
-    app.source_workspace = Workspace::new(app.document.bundle(), true);
-    app.selected = app.project().id;
-    app.refresh_draft();
-    app.page = Page::Text;
-    app.show_source_file(false);
-    app.publish_source_diagnostics(app.document.compiled().diagnostics.clone());
-    app
-}
-fn send(app: &mut App, message: Message) {
-    let _ = app.update(message);
-}
-fn save(app: &mut App, path: &Path) {
-    let receipt = write_snapshot(
-        app.canvas_document,
-        app.document.revision(),
-        app.document.snapshot(),
-        path.to_owned(),
-        app.disk_project.clone(),
-    )
-    .unwrap();
-    send(app, Message::Saved(Ok(Some(receipt))));
-}
-fn reveal(app: &mut App) {
-    if let Some(ticket) = app.source_reveal_ticket() {
-        send(app, Message::SourceViewport(Some(ticket)));
-    }
-}
-fn query(app: &mut App, action: nav::query::Action) -> nav::Completion {
-    let message = app.source_symbol_message(nav::SymbolEvent::Query(action));
-    send(app, message);
-    let request = app.source_symbols.request.clone().expect("admitted query");
-    assert_eq!(app.source_symbols.in_flight, Some(request.job));
-    let snapshot = Arc::new(app.with_source_input(|input| {
-        nav::query::admit_owned(input, nav::query::Limits::default())
-            .unwrap()
-            .capture()
-            .unwrap()
-    }));
-    let results = Arc::new(
-        snapshot
-            .query(nav::query::Query {
-                stamp: request.stamp,
-                path: &request.path,
-                byte_offset: request.offset,
-                action,
-            })
-            .unwrap(),
-    );
-    nav::Completion {
-        request,
-        result: Ok((snapshot, results)),
-    }
-}
-fn seed_navigation(app: &mut App, pending: bool) -> Option<nav::Completion> {
-    let text = app.source_workspace.text();
-    let start = text.find("oa_activity assess").unwrap() + "oa_activity ".len();
-    let prefix = &text[..start];
-    let position = widget::text_editor::Position {
-        line: prefix.bytes().filter(|byte| *byte == b'\n').count(),
-        column: prefix.rsplit_once('\n').unwrap().1.len(),
-    };
-    app.source_editor.move_to(Cursor {
-        position,
-        selection: None,
-    });
-    let ready = query(app, nav::query::Action::Definition);
-    send(app, Message::SourceSymbolsReady(ready));
-    reveal(app);
-    assert_eq!(app.source_symbols.back.len(), 1);
-    let ready = query(app, nav::query::Action::References);
-    send(app, Message::SourceSymbolsReady(ready));
-    assert!(app.source_symbols.results.is_some() && app.source_symbols.cache.is_some());
-    assert!(app.source_symbols.display_request.is_some());
-    assert_eq!(app.text_workspace.drawer(), Some(DrawerTab::References));
-    if pending {
-        Some(query(app, nav::query::Action::Definition))
-    } else {
-        None
-    }
-}
-fn warning(app: &App) -> SourceDiagnostic {
-    let source = app.source_workspace.text();
-    let primary = source.find("model").unwrap();
-    let related = source.find("assess").unwrap();
-    SourceDiagnostic {
-        path: app.source_workspace.active.clone(),
-        diagnostic: Diagnostic {
-            severity: Severity::Warning,
-            code: "lifecycle_warning".into(),
-            object_id: None,
-            field: None,
-            line: 2,
-            column: 9,
-            message: "Retained warning with a related source location".into(),
-            span: Span {
-                start: primary,
-                end: primary + 5,
-            },
-        },
-        related: vec![SourceLocation {
-            path: app.source_workspace.active.clone(),
-            span: Span {
-                start: related,
-                end: related + 6,
-            },
-        }],
-    }
-}
-fn warning_messages(app: &App) -> [Message; 2] {
-    let warning = &app.source_diagnostics[0];
-    [
-        app.text_diagnostic_message(SourceLocation {
-            path: warning.path.clone(),
-            span: warning.diagnostic.span,
-        })
-        .unwrap(),
-        app.text_diagnostic_message(warning.related[0].clone())
-            .unwrap(),
-    ]
-}
-fn assert_cleared(app: &App, job: Option<Id>) {
-    assert_eq!(app.source_symbols.in_flight, job);
-    assert!(app.source_symbols.request.is_none() && app.source_symbols.display_request.is_none());
-    assert!(app.source_symbols.results.is_none() && app.source_symbols.cache.is_none());
-    assert!(app.source_symbols.back.is_empty());
-    assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-    assert!(app.text_workspace.drawer().is_none() && app.text_workspace.menu().is_none());
-    assert!(app.text_workspace.references().stamp().is_none());
-}
-
-#[test]
-fn saved_new_destination_republishes_current_warning_and_refuses_old_primary_and_related() {
-    let first = tempfile::tempdir().unwrap();
-    let second = tempfile::tempdir().unwrap();
-    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
-    let second_path = second
-        .path()
-        .canonicalize()
-        .unwrap()
-        .join("project.arcadia");
-    let mut app = fixture();
-    save(&mut app, &first_path);
-    let ready = seed_navigation(&mut app, true).unwrap();
-    let job = ready.request.job;
-    app.publish_source_diagnostics(vec![warning(&app)]);
-    send(
-        &mut app,
-        Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-    );
-    let old = warning_messages(&app);
-    let warnings = app.source_diagnostics.clone();
-    let publication = app.text_workspace.diagnostic_publication().unwrap();
-    let source = app.source_key();
-    let accepted = app.document.snapshot();
-    let revision = app.document.revision();
-    let raw = app.source_workspace.bundle();
-    save(&mut app, &second_path);
-    assert_eq!(app.path.as_deref(), Some(second_path.as_path()));
-    assert_ne!(app.source_key().workspace, source.workspace);
-    assert_eq!(app.source_workspace.bundle(), raw);
-    assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-    assert_eq!(app.document.revision(), revision);
-    assert_eq!(std::fs::read_to_string(&first_path).unwrap(), VALID);
-    assert_eq!(std::fs::read_to_string(&second_path).unwrap(), VALID);
-    assert_eq!(app.source_diagnostics, warnings);
-    let current = app
-        .text_workspace
-        .diagnostic_publication()
-        .expect("identity-only save retained current warnings");
-    assert_eq!(current.source(), app.source_key());
-    assert_ne!(current.generation(), publication.generation());
-    assert_cleared(&app, Some(job));
-    for message in old {
-        let interaction = app.source_symbols.interaction;
-        send(&mut app, message);
-        assert_eq!(app.source_symbols.interaction, interaction);
-        assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-    }
-    send(
-        &mut app,
-        Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-    );
-    for message in warning_messages(&app) {
-        send(&mut app, message);
-        assert!(
-            app.source_symbols.reveal.is_some(),
-            "fresh primary and related warnings remain actionable"
-        );
-        reveal(&mut app);
-    }
-    let cursor = app.source_editor.cursor();
-    send(&mut app, Message::SourceSymbolsReady(ready));
-    assert!(app.source_symbols.in_flight.is_none());
-    assert!(app.source_symbols.results.is_none());
-    assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-    assert_eq!(app.source_editor.cursor(), cursor);
-    assert_eq!(app.source_workspace.bundle(), raw);
-    assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-    assert!(!app.document.can_undo() && !app.document.can_redo());
-}
-
-#[test]
-fn invalid_repair_open_clears_prior_presentation_and_publishes_current_problems_preserving_worker()
-{
-    for pending in [false, true] {
-        let directory = tempfile::tempdir().unwrap();
-        let path = directory
-            .path()
-            .canonicalize()
-            .unwrap()
-            .join("broken.arcadia");
-        let invalid = format!(
-            "{}    include \"missing.arcadia\";\r\n}}\r\n",
-            VALID.strip_suffix("}\r\n").unwrap()
-        );
-        std::fs::write(&path, &invalid).unwrap();
-        let mut app = fixture();
-        let ready = seed_navigation(&mut app, pending);
-        let job = ready.as_ref().map(|ready| ready.request.job);
-        app.publish_source_diagnostics(vec![warning(&app)]);
-        send(
-            &mut app,
-            Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-        );
-        let old = warning_messages(&app);
-        let old_publication = app.text_workspace.diagnostic_publication().unwrap();
-        let old_source = app.source_key();
-        let accepted = app.document.snapshot();
-        let open_menu = app.text_menu_message(Point::new(20., 20.));
-        send(&mut app, open_menu);
-        assert!(app.text_workspace.menu().is_some());
-        let loaded = read_snapshot(path.clone()).unwrap();
-        send(&mut app, Message::Loaded(Ok(Some(loaded))));
-        assert!(!app.source_workspace.applied);
-        assert_eq!(app.path.as_deref(), Some(path.as_path()));
-        assert_ne!(app.source_key().workspace, old_source.workspace);
-        assert_eq!(app.source_workspace.text(), invalid);
-        assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-        assert_cleared(&app, job);
-        assert!(
-            app.source_diagnostics
-                .iter()
-                .any(|issue| issue.diagnostic.severity == Severity::Error)
-        );
-        let publication = app.text_workspace.diagnostic_publication().unwrap();
-        assert_eq!(publication.source(), app.source_key());
-        assert_ne!(publication.generation(), old_publication.generation());
-        for message in old {
-            send(&mut app, message);
-        }
-        assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-        send(
-            &mut app,
-            Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-        );
-        let issue = app
-            .source_diagnostics
-            .iter()
-            .find(|issue| {
-                issue.path == app.source_workspace.active
-                    && issue.diagnostic.span.end <= invalid.len()
-            })
-            .unwrap();
-        let current = app
-            .text_diagnostic_message(SourceLocation {
-                path: issue.path.clone(),
-                span: issue.diagnostic.span,
-            })
-            .unwrap();
-        send(&mut app, current);
-        assert!(app.source_symbols.reveal.is_some());
-        reveal(&mut app);
-        if let Some(ready) = ready {
-            send(&mut app, Message::SourceSymbolsReady(ready));
-        }
-        assert!(app.source_symbols.in_flight.is_none());
-        assert!(app.source_symbols.results.is_none());
-        assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-        assert_eq!(app.source_workspace.text(), invalid);
-        assert_eq!(std::fs::read_to_string(&path).unwrap(), invalid);
-        assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-        assert!(!app.document.can_undo() && !app.document.can_redo());
-    }
-}
-
-#[test]
-fn canceled_or_failed_open_that_installs_nothing_retains_current_presentation_and_diagnostics() {
-    for failed in [false, true] {
-        let mut app = fixture();
-        seed_navigation(&mut app, false);
-        app.publish_source_diagnostics(vec![warning(&app)]);
-        let results = app.source_symbols.results.clone().unwrap();
-        let cache = app.source_symbols.cache.clone().unwrap();
-        let display = app.source_symbols.display_request.clone();
-        let back = app
-            .source_symbols
-            .back
-            .iter()
-            .map(|entry| {
-                (
-                    entry.session,
-                    entry.path.clone(),
-                    entry.generation,
-                    entry.cursor,
-                )
-            })
-            .collect::<Vec<_>>();
-        let key = app.source_key();
-        let accepted = app.document.snapshot();
-        let raw = app.source_workspace.bundle();
-        let cursor = app.source_editor.cursor();
-        let publication = app.text_workspace.diagnostic_publication();
-        let diagnostics = app.source_diagnostics.clone();
-        let visit = app.text_workspace.drawer_visit();
-        let result = if failed {
-            Err("Fixture read failed before installing a workspace".into())
-        } else {
-            Ok(None)
-        };
-        send(&mut app, Message::Loaded(result));
-        assert_eq!(app.source_key(), key);
-        assert_eq!(app.text_workspace.diagnostic_publication(), publication);
-        assert_eq!(app.source_diagnostics, diagnostics);
-        assert_eq!(app.text_workspace.drawer(), Some(DrawerTab::References));
-        assert_eq!(app.text_workspace.drawer_visit(), visit);
-        assert!(Arc::ptr_eq(
-            app.source_symbols.results.as_ref().unwrap(),
-            &results
-        ));
-        assert!(Arc::ptr_eq(
-            app.source_symbols.cache.as_ref().unwrap(),
-            &cache
-        ));
-        assert_eq!(app.source_symbols.display_request, display);
-        assert_eq!(
-            app.source_symbols
-                .back
-                .iter()
-                .map(|entry| (
-                    entry.session,
-                    entry.path.clone(),
-                    entry.generation,
-                    entry.cursor
-                ))
-                .collect::<Vec<_>>(),
-            back
-        );
-        assert_eq!(app.source_workspace.bundle(), raw);
-        assert_eq!(app.source_editor.cursor(), cursor);
-        assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-    }
-}
-
-#[test]
-fn saved_new_destination_does_not_revalidate_already_stale_warning_locations() {
-    let first = tempfile::tempdir().unwrap();
-    let second = tempfile::tempdir().unwrap();
-    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
-    let second_path = second
-        .path()
-        .canonicalize()
-        .unwrap()
-        .join("project.arcadia");
-    let mut app = fixture();
-    save(&mut app, &first_path);
-    app.publish_source_diagnostics(vec![warning(&app)]);
-    send(
-        &mut app,
-        Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-    );
-    let old = warning_messages(&app);
-    let publication = app.text_workspace.diagnostic_publication().unwrap();
-    let draft = format!("{VALID}// unsaved current draft\r\n");
-    app.source_workspace
-        .edit(draft.clone(), app.source_editor.cursor());
-    app.show_source_file(false);
-    assert_ne!(publication.source(), app.source_key());
-    let accepted = app.document.snapshot();
-    save(&mut app, &second_path);
-    assert!(
-        app.text_workspace.diagnostic_publication().is_none(),
-        "identity-only reset cannot turn an old source span into a current warning"
-    );
-    send(
-        &mut app,
-        Message::TextWorkspace(Event::ShowDrawer(DrawerTab::Problems)),
-    );
-    assert!(
-        app.text_diagnostic_message(SourceLocation {
-            path: app.source_diagnostics[0].path.clone(),
-            span: app.source_diagnostics[0].diagnostic.span,
-        })
-        .is_none()
-    );
-    for message in old {
-        send(&mut app, message);
-    }
-    assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-    assert_eq!(app.source_workspace.text(), draft);
-    assert!(app.source_dirty());
-    assert!(Arc::ptr_eq(&app.document.snapshot(), &accepted));
-    assert_eq!(
-        std::fs::read_to_string(&second_path).unwrap(),
-        VALID,
-        "receipt records accepted bytes while the newer draft remains unsaved"
-    );
-}

crates/oa-desktop/src/app/text_workspace/tests.rs

@@ -1,692 +0,0 @@
-use super::*;
-use crate::app::Page;
-use oa_core::{Project, language::Span};
-use std::sync::Arc;
-
-fn fixture() -> App {
-    let mut app = App::with_project(Project::empty());
-    app.page = Page::Text;
-    let diagnostics = app.source_diagnostics.clone();
-    app.publish_source_diagnostics(diagnostics);
-    assert!(app.source_navigation_available());
-    app
-}
-fn send(app: &mut App, event: Event) {
-    // Exercise the real envelope path; worker/lint futures are deliberately not
-    // polled here. The parent owns serialized compile/runtime verification.
-    let _ = app.update(Message::TextWorkspace(event));
-}
-fn toggle(app: &App, stamp: QueryStamp, path: String) -> Event {
-    Event::ToggleFile {
-        stamp,
-        visit: app.text_workspace.drawer_visit(),
-        path,
-    }
-}
-fn open(app: &mut App) -> Id {
-    let message = app.text_menu_message(Point::new(10., 20.));
-    let _ = app.update(message);
-    app.text_workspace.menu().unwrap().token()
-}
-fn invoke(app: &mut App, token: Id, command: Command) {
-    send(app, Event::Invoke { token, command });
-}
-fn enabled(app: &App, command: Command) -> bool {
-    app.text_workspace
-        .menu
-        .as_ref()
-        .unwrap()
-        .entries
-        .iter()
-        .find(|entry| entry.command == command)
-        .is_some_and(|entry| entry.action.is_some())
-}
-fn back_entry(app: &App) -> nav::HistoryEntry {
-    nav::HistoryEntry {
-        session: app.source_workspace.session(),
-        path: app.source_workspace.active.clone(),
-        generation: app.source_workspace.files[&app.source_workspace.active].generation(),
-        cursor: app.source_editor.cursor(),
-    }
-}
-fn stamp(app: &App, serial: u64) -> QueryStamp {
-    QueryStamp {
-        snapshot: app.source_key(),
-        serial,
-    }
-}
-fn location(app: &App, start: usize, end: usize) -> SourceLocation {
-    SourceLocation {
-        path: app.source_workspace.active.clone(),
-        span: Span { start, end },
-    }
-}
-
-#[test]
-fn menu_own_open_invalidation_does_not_stale_find_and_invoke_is_once() {
-    let mut app = fixture();
-    let old_interaction = app.source_symbols.interaction;
-    let token = open(&mut app);
-    assert_ne!(old_interaction, app.source_symbols.interaction);
-    assert_eq!(
-        app.text_workspace.menu.as_ref().unwrap().context,
-        app.text_command_context()
-    );
-    assert!(enabled(&app, Command::Find));
-    invoke(&mut app, token, Command::Find);
-    assert!(app.source_navigation.open);
-    assert!(app.text_workspace.menu().is_none());
-    let instance = app.source_find_instance;
-    invoke(&mut app, token, Command::Find);
-    assert_eq!(
-        app.source_find_instance, instance,
-        "replay must not reopen Find"
-    );
-}
-
-#[test]
-fn disabled_entry_cannot_become_a_new_action_under_the_same_menu_token() {
-    let mut app = fixture();
-    let token = open(&mut app);
-    assert!(!enabled(&app, Command::Back));
-    app.source_symbols.back.push(back_entry(&app));
-    assert!(
-        !enabled(&app, Command::Back),
-        "frozen presentation must remain disabled"
-    );
-    invoke(&mut app, token, Command::Back);
-    assert_eq!(
-        app.source_symbols.back.len(),
-        1,
-        "a newly enabled action cannot be substituted"
-    );
-    assert!(app.source_symbols.reveal.is_none());
-}
-
-#[test]
-fn enabled_entry_is_readmitted_at_dispatch_and_blocked_by_busy() {
-    let mut app = fixture();
-    let token = open(&mut app);
-    assert!(enabled(&app, Command::Find));
-    app.busy = true;
-    assert!(enabled(&app, Command::Find));
-    invoke(&mut app, token, Command::Find);
-    assert!(!app.source_navigation.open);
-    assert!(app.text_workspace.menu().is_none());
-}
-
-#[test]
-fn old_dismiss_and_invoke_do_not_consume_a_newer_menu() {
-    let mut app = fixture();
-    let old = open(&mut app);
-    send(&mut app, Event::DismissMenu(old));
-    let new = open(&mut app);
-    send(&mut app, Event::DismissMenu(old));
-    invoke(&mut app, old, Command::Find);
-    assert_eq!(app.text_workspace.menu().unwrap().token(), new);
-    assert!(!app.source_navigation.open);
-}
-
-#[test]
-fn menu_source_caret_document_path_and_interaction_changes_refuse_stale_find() {
-    for change in 0..6 {
-        let mut app = fixture();
-        let token = open(&mut app);
-        match change {
-            0 => {
-                let value = format!("{}\n// changed", app.source_workspace.text());
-                app.source_workspace.edit(value, app.source_editor.cursor());
-            }
-            1 => {
-                let mut cursor = app.source_editor.cursor();
-                cursor.position.column += 1;
-                app.source_editor.move_to(cursor);
-            }
-            2 => app.canvas_document = Id::new_v4(),
-            3 => app.source_workspace.active = "other.arcadia".into(),
-            4 => app.source_symbols.interaction = Id::new_v4(),
-            _ => {
-                let mut bundle = app.document.bundle().clone();
-                bundle
-                    .files
-                    .get_mut(&bundle.entry)
-                    .unwrap()
-                    .push_str("\n// accepted revision");
-                assert!(app.document.apply_bundle(bundle).unwrap());
-            }
-        }
-        invoke(&mut app, token, Command::Find);
-        assert!(!app.source_navigation.open, "stale context case {change}");
-    }
-}
-
-#[test]
-fn source_and_property_drafts_keep_find_and_text_undo_without_model_application() {
-    let mut app = fixture();
-    let accepted = app.document.bundle().clone();
-    let revision = app.document.revision();
-    let pending_name = "Pending property draft";
-    // Use the actual property input route before source edits coexist. Changing
-    // Draft::value alone is overwritten by its authoritative raw input buffer.
-    let _ = app.update(Message::Field("/name".into(), pending_name.into()));
-    let assert_pending_property = |app: &App| {
-        let draft = app.draft.as_ref().unwrap();
-        assert!(draft.dirty());
-        assert_eq!(draft.inputs["/name"].raw, pending_name);
-        assert_eq!(draft.inputs["/name"].editor.text(), pending_name);
-        assert_eq!(
-            draft.materialize().unwrap()["name"].as_str(),
-            Some(pending_name)
-        );
-    };
-    assert_pending_property(&app);
-    let initial = app.source_workspace.text().to_owned();
-    app.source_workspace
-        .edit(format!("{initial}\n// draft"), app.source_editor.cursor());
-    app.show_source_file(false);
-    assert!(app.source_dirty() && app.draft_dirty());
-    let token = open(&mut app);
-    assert!(enabled(&app, Command::Find) && enabled(&app, Command::UndoText));
-    assert!(!enabled(&app, Command::RenameAlias) && !enabled(&app, Command::UndoModel));
-    invoke(&mut app, token, Command::Find);
-    assert!(app.source_navigation.open);
-    assert_pending_property(&app);
-    let token = open(&mut app);
-    invoke(&mut app, token, Command::UndoText);
-    assert_eq!(app.source_workspace.text(), initial);
-    assert_pending_property(&app);
-    assert_eq!(app.document.revision(), revision);
-    assert_eq!(app.document.bundle(), &accepted);
-}
-
-#[test]
-fn queued_toolbar_request_cannot_retarget_after_source_change() {
-    let mut app = fixture();
-    let request = app.text_command_message(Command::Find);
-    app.source_workspace
-        .edit("// changed".into(), app.source_editor.cursor());
-    let _ = app.update(request);
-    assert!(!app.source_navigation.open);
-}
-
-#[test]
-fn equal_diagnostic_republication_invalidates_primary_and_related_targets() {
-    let mut app = fixture();
-    send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-    let primary = app.text_diagnostic_message(location(&app, 0, 1)).unwrap();
-    let related = app.text_diagnostic_message(location(&app, 1, 2)).unwrap();
-    let previous = app.text_workspace.diagnostic_publication().unwrap();
-    app.publish_source_diagnostics(app.source_diagnostics.clone());
-    let current = app.text_workspace.diagnostic_publication().unwrap();
-    assert_eq!(previous.source(), current.source());
-    assert_ne!(previous.generation(), current.generation());
-    for message in [primary, related] {
-        let interaction = app.source_symbols.interaction;
-        let _ = app.update(message);
-        assert_eq!(app.source_symbols.interaction, interaction);
-        assert!(app.source_symbols.reveal.is_none());
-    }
-}
-
-#[test]
-fn current_diagnostic_target_navigates_but_changed_source_or_clear_refuses_it() {
-    let mut app = fixture();
-    send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-    let message = app.text_diagnostic_message(location(&app, 0, 1)).unwrap();
-    let _ = app.update(message);
-    assert!(app.source_symbols.reveal.is_some());
-    app.source_interaction();
-    let message = app.text_diagnostic_message(location(&app, 0, 1)).unwrap();
-    app.source_workspace
-        .edit("// newer".into(), app.source_editor.cursor());
-    let _ = app.update(message);
-    assert!(app.source_symbols.reveal.is_none());
-    assert!(app.text_diagnostic_message(location(&app, 0, 1)).is_none());
-    app.publish_source_diagnostics(Vec::new());
-    let message = app.text_diagnostic_message(location(&app, 0, 1)).unwrap();
-    app.publish_source_diagnostics(Vec::new());
-    let _ = app.update(message);
-    assert!(app.source_symbols.reveal.is_none());
-}
-
-#[test]
-fn diagnostic_span_must_be_loaded_ordered_and_utf8_exact() {
-    let mut app = fixture();
-    send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-    app.source_workspace
-        .edit("a雨b".into(), app.source_editor.cursor());
-    app.show_source_file(false);
-    app.publish_source_diagnostics(Vec::new());
-    let mut missing = location(&app, 0, 1);
-    missing.path = "missing.arcadia".into();
-    for target in [
-        location(&app, 3, 2),
-        location(&app, 0, 6),
-        location(&app, 2, 4),
-        location(&app, 1, 3),
-        missing,
-    ] {
-        let message = app.text_diagnostic_message(target).unwrap();
-        let _ = app.update(message);
-        assert!(app.source_symbols.reveal.is_none());
-    }
-    let message = app.text_diagnostic_message(location(&app, 1, 4)).unwrap();
-    let _ = app.update(message);
-    assert!(app.source_symbols.reveal.is_some());
-}
-
-#[test]
-fn reference_groups_and_scroll_survive_tabs_and_reject_old_visits_and_queries() {
-    let mut app = fixture();
-    let first = stamp(&app, 1);
-    app.text_workspace
-        .begin_references(first, "b/use.arcadia".into());
-    app.text_workspace
-        .install_reference_files(first, ["a/use.arcadia".into(), "b/use.arcadia".into()]);
-    assert!(app.text_workspace.references().collapsed("a/use.arcadia"));
-    assert!(!app.text_workspace.references().collapsed("b/use.arcadia"));
-    let event = toggle(&app, first, "a/use.arcadia".into());
-    send(&mut app, event);
-    let old_visit = app.text_workspace.drawer_visit();
-    let old_scroll_id = app.text_workspace.reference_scroll_id();
-    let interaction = app.source_symbols.interaction;
-    send(
-        &mut app,
-        Event::ReferenceScrolled {
-            stamp: first,
-            visit: old_visit,
-            y: 123.,
-        },
-    );
-    assert_eq!(
-        app.source_symbols.interaction, interaction,
-        "scroll is passive"
-    );
-    send(&mut app, Event::ShowDrawer(DrawerTab::Status));
-    send(
-        &mut app,
-        Event::ReferenceScrolled {
-            stamp: first,
-            visit: old_visit,
-            y: 0.,
-        },
-    );
-    send(&mut app, Event::ShowDrawer(DrawerTab::References));
-    assert_eq!(app.text_workspace.references().scroll_y(), 123.);
-    assert!(!app.text_workspace.references().collapsed("a/use.arcadia"));
-    send(
-        &mut app,
-        Event::ReferenceScrolled {
-            stamp: first,
-            visit: old_visit,
-            y: 0.,
-        },
-    );
-    assert_eq!(app.text_workspace.references().scroll_y(), 123.);
-    assert_ne!(app.text_workspace.reference_scroll_id(), old_scroll_id);
-    let second = stamp(&app, 2);
-    app.text_workspace
-        .begin_references(second, "absent.arcadia".into());
-    app.text_workspace
-        .install_reference_files(first, ["old.arcadia".into()]);
-    app.text_workspace
-        .install_reference_files(second, ["b/use.arcadia".into(), "a/use.arcadia".into()]);
-    assert_eq!(app.text_workspace.references().scroll_y(), 0.);
-    assert!(!app.text_workspace.references().collapsed("a/use.arcadia"));
-    assert!(app.text_workspace.references().collapsed("b/use.arcadia"));
-    let event = toggle(&app, first, "b/use.arcadia".into());
-    send(&mut app, event);
-    assert!(app.text_workspace.references().collapsed("b/use.arcadia"));
-}
-
-#[test]
-fn reset_removes_ui_and_publication_authority_and_resize_rejects_nan() {
-    let mut app = fixture();
-    open(&mut app);
-    app.text_workspace.reset();
-    assert!(app.text_workspace.menu().is_none());
-    assert!(app.text_workspace.diagnostic_publication().is_none());
-    assert!(app.text_workspace.drawer().is_none());
-    send(&mut app, Event::ResizeDrawer(f32::NAN));
-    assert_eq!(app.text_workspace.drawer_height(), 180.);
-    send(&mut app, Event::ResizeDrawer(f32::MAX));
-    assert_eq!(app.text_workspace.drawer_height(), 1200.);
-}
-
-#[test]
-fn only_valid_explicit_group_and_resize_intent_cancel_pending_navigation() {
-    let mut app = fixture();
-    let current = stamp(&app, 1);
-    app.text_workspace
-        .begin_references(current, "uses.arcadia".into());
-    app.text_workspace
-        .install_reference_files(current, ["uses.arcadia".into()]);
-    let request = nav::Request {
-        job: Id::new_v4(),
-        interaction: app.source_symbols.interaction,
-        raw_interaction: 0,
-        stamp: current,
-        path: app.source_workspace.active.clone(),
-        offset: 0,
-        cursor: app.source_editor.cursor(),
-        action: nav::query::Action::References,
-    };
-    app.source_symbols.request = Some(request.clone());
-    app.source_symbols.in_flight = Some(request.job);
-    let interaction = app.source_symbols.interaction;
-    let event = toggle(&app, current, "not-a-group.arcadia".into());
-    send(&mut app, event);
-    let old = QueryStamp {
-        serial: 0,
-        ..current
-    };
-    let event = toggle(&app, old, "uses.arcadia".into());
-    send(&mut app, event);
-    send(&mut app, Event::ResizeDrawer(f32::NAN));
-    send(&mut app, Event::ResizeDrawer(180.));
-    assert_eq!(app.source_symbols.interaction, interaction);
-    assert!(app.source_symbols.request.is_some());
-    let event = toggle(&app, current, "uses.arcadia".into());
-    send(&mut app, event);
-    assert!(app.source_symbols.request.is_none());
-    assert_ne!(app.source_symbols.interaction, interaction);
-    assert_eq!(
-        app.source_symbols.in_flight,
-        Some(request.job),
-        "intent does not release an occupied worker"
-    );
-    app.source_symbols.request = Some(request.clone());
-    send(&mut app, Event::ResizeDrawer(240.));
-    assert!(app.source_symbols.request.is_none());
-    app.source_symbols.request = Some(request.clone());
-    send(&mut app, Event::HideDrawer);
-    assert!(app.source_symbols.request.is_none());
-    assert_eq!(app.source_symbols.in_flight, Some(request.job));
-    assert_eq!(app.text_workspace.references().stamp(), Some(current));
-}
-
-#[test]
-fn stale_retained_group_can_expand_without_navigating_or_applying_drafts() {
-    let mut app = fixture();
-    let current = stamp(&app, 1);
-    let path = app.source_workspace.active.clone();
-    app.text_workspace.begin_references(current, path.clone());
-    app.text_workspace
-        .install_reference_files(current, [path.clone()]);
-    let event = toggle(&app, current, path.clone());
-    send(&mut app, event);
-    assert!(app.text_workspace.references().collapsed(&path));
-    let accepted = app.document.snapshot();
-    let _ = app.update(Message::SourceEdit(widget::text_editor::Action::Edit(
-        widget::text_editor::Edit::Insert(' '),
-    )));
-    assert_ne!(current.snapshot, app.source_key());
-    let raw = app.source_workspace.bundle();
-    let cursor = app.source_editor.cursor();
-    let event = toggle(&app, current, path.clone());
-    send(&mut app, event);
-    assert!(!app.text_workspace.references().collapsed(&path));
-    assert_eq!(app.source_workspace.active, path);
-    assert_eq!(app.source_workspace.bundle(), raw);
-    assert_eq!(app.source_editor.cursor(), cursor);
-    assert!(app.source_symbols.reveal.is_none() && app.source_symbols.back.is_empty());
-    assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
-}
-
-#[test]
-fn document_reset_preserves_popup_token_sequence_and_drops_old_menu_authority() {
-    let mut app = fixture();
-    let old = open(&mut app);
-    let sequence = app.text_workspace_menu().unwrap().token;
-    app.reset(Project::empty(), None);
-    assert!(app.text_workspace.menu().is_none());
-    app.page = Page::Text;
-    let fresh = open(&mut app);
-    assert_ne!(old, fresh);
-    assert!(app.text_workspace_menu().unwrap().token > sequence);
-    invoke(&mut app, old, Command::Find);
-    assert!(!app.source_navigation.open);
-    assert_eq!(app.text_workspace.menu().unwrap().token(), fresh);
-}
-
-#[test]
-fn retained_primary_and_related_targets_cannot_replay_after_hide_or_problems_references_problems() {
-    for hide in [false, true] {
-        let mut app = fixture();
-        send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-        let old_visit = app.text_workspace.drawer_visit();
-        let publication = app.text_workspace.diagnostic_publication();
-        let targets = [location(&app, 0, 1), location(&app, 1, 2)];
-        let old = targets
-            .iter()
-            .cloned()
-            .map(|target| app.text_diagnostic_message(target).unwrap())
-            .collect::<Vec<_>>();
-        let accepted = app.document.snapshot();
-        let raw = app.source_workspace.bundle();
-        let history = (
-            app.document.revision(),
-            app.document.can_undo(),
-            app.document.can_redo(),
-            app.document.dirty(),
-        );
-        let event = if hide {
-            Event::HideDrawer
-        } else {
-            Event::ShowDrawer(DrawerTab::References)
-        };
-        send(&mut app, event);
-        for reopened in [false, true] {
-            if reopened {
-                send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-            } else {
-                assert!(app.text_diagnostic_message(targets[0].clone()).is_none());
-            }
-            assert_ne!(app.text_workspace.drawer_visit(), old_visit);
-            assert_eq!(
-                app.text_workspace.diagnostic_publication(),
-                publication,
-                "same list and source isolate the visit guard from publication freshness"
-            );
-            let context = app.text_command_context();
-            let drawer = app.text_workspace.drawer();
-            let visit = app.text_workspace.drawer_visit();
-            for message in old.iter().cloned() {
-                let _ = app.update(message);
-                assert_eq!(
-                    app.text_command_context(),
-                    context,
-                    "stale diagnostic must fail before interaction invalidation"
-                );
-                assert_eq!(app.text_workspace.drawer(), drawer);
-                assert_eq!(app.text_workspace.drawer_visit(), visit);
-                assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-                assert!(app.source_symbols.back.is_empty());
-                assert_eq!(app.source_workspace.bundle(), raw);
-                assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-                assert_eq!(
-                    (
-                        app.document.revision(),
-                        app.document.can_undo(),
-                        app.document.can_redo(),
-                        app.document.dirty()
-                    ),
-                    history
-                );
-            }
-        }
-        for target in targets {
-            let fresh = app.text_diagnostic_message(target).unwrap();
-            let _ = app.update(fresh);
-            assert!(
-                app.source_symbols.reveal.is_some(),
-                "fresh primary and related targets remain usable"
-            );
-            app.source_interaction();
-        }
-        assert_eq!(app.source_workspace.bundle(), raw);
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-    }
-}
-
-#[test]
-fn queued_group_toggle_cannot_mutate_a_reopened_or_rotated_visit() {
-    for replacement in 0..3 {
-        let mut app = fixture();
-        let current = stamp(&app, 1);
-        app.text_workspace
-            .begin_references(current, "a.arcadia".into());
-        app.text_workspace
-            .install_reference_files(current, ["a.arcadia".into(), "b.arcadia".into()]);
-        let old = toggle(&app, current, "a.arcadia".into());
-        let old_visit = app.text_workspace.drawer_visit();
-        match replacement {
-            0 => {
-                send(&mut app, Event::HideDrawer);
-                send(&mut app, Event::ShowDrawer(DrawerTab::References));
-            }
-            1 => {
-                send(&mut app, Event::ShowDrawer(DrawerTab::Problems));
-                send(&mut app, Event::ShowDrawer(DrawerTab::References));
-            }
-            _ => {
-                let event = toggle(&app, current, "b.arcadia".into());
-                send(&mut app, event);
-            }
-        }
-        let visit = app.text_workspace.drawer_visit();
-        assert_ne!(visit, old_visit);
-        send(
-            &mut app,
-            Event::ReferenceScrolled {
-                stamp: current,
-                visit,
-                y: 84.,
-            },
-        );
-        let scroll_id = app.text_workspace.reference_scroll_id();
-        let request = nav::Request {
-            job: Id::new_v4(),
-            interaction: app.source_symbols.interaction,
-            raw_interaction: 0,
-            stamp: current,
-            path: app.source_workspace.active.clone(),
-            offset: 0,
-            cursor: app.source_editor.cursor(),
-            action: nav::query::Action::References,
-        };
-        app.source_symbols.request = Some(request.clone());
-        app.source_symbols.in_flight = Some(request.job);
-        let groups =
-            ["a.arcadia", "b.arcadia"].map(|path| app.text_workspace.references().collapsed(path));
-        let context = app.text_command_context();
-        let accepted = app.document.snapshot();
-        let raw = app.source_workspace.bundle();
-        for _ in 0..2 {
-            send(&mut app, old.clone());
-            assert_eq!(app.text_workspace.drawer_visit(), visit);
-            assert_eq!(app.text_workspace.references().scroll_y(), 84.);
-            assert_eq!(app.text_workspace.reference_scroll_id(), scroll_id);
-            assert_eq!(app.text_workspace.references().stamp(), Some(current));
-            assert_eq!(
-                ["a.arcadia", "b.arcadia"]
-                    .map(|path| app.text_workspace.references().collapsed(path)),
-                groups,
-            );
-            assert_eq!(app.text_command_context(), context);
-            assert_eq!(app.source_symbols.request.as_ref(), Some(&request));
-            assert_eq!(app.source_symbols.in_flight, Some(request.job));
-            assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-        }
-        let fresh = toggle(&app, current, "a.arcadia".into());
-        send(&mut app, fresh);
-        assert_eq!(
-            app.text_workspace.references().collapsed("a.arcadia"),
-            !groups[0]
-        );
-        assert_ne!(app.text_workspace.drawer_visit(), visit);
-        assert_ne!(app.source_symbols.interaction, context.interaction);
-        assert!(app.source_symbols.request.is_none());
-        assert_eq!(app.source_symbols.in_flight, Some(request.job));
-        assert!(app.source_symbols.reveal.is_none() && app.source_jump.is_none());
-        assert!(app.source_symbols.back.is_empty());
-        assert_eq!(app.source_workspace.bundle(), raw);
-        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        assert!(!app.document.can_undo() && !app.document.can_redo());
-    }
-}
-
-#[test]
-fn annotation_snapshot_requires_exact_current_bytes_and_publication() {
-    let mut app = fixture();
-    let original_model = app.document.snapshot();
-    let original_source = app.source_snapshot.clone();
-    let publication = app.source_annotation_snapshot().unwrap().publication;
-    let initial = app.source_annotation_snapshot().unwrap();
-    assert!(Arc::ptr_eq(&initial.source, &original_source));
-    assert_eq!(initial.path, app.source_workspace.active);
-    assert!(std::ptr::eq(
-        initial.diagnostics,
-        app.source_diagnostics.as_slice()
-    ));
-
-    // Republish identical diagnostics: old cached geometry must get a new identity.
-    app.publish_source_diagnostics(app.source_diagnostics.clone());
-    assert_ne!(
-        app.source_annotation_snapshot().unwrap().publication,
-        publication
-    );
-
-    app.source_workspace
-        .edit("// newer draft\n".into(), app.source_editor.cursor());
-    assert!(
-        app.source_annotation_snapshot().is_none(),
-        "old publication after a real draft edit"
-    );
-    // A current source key alone must not bind new ranges to the old displayed text.
-    app.publish_source_diagnostics(Vec::new());
-    assert!(
-        app.source_annotation_snapshot().is_none(),
-        "displayed snapshot still contains old bytes"
-    );
-    app.show_source_file(false);
-    let current = app.source_annotation_snapshot().unwrap();
-    assert_eq!(current.source.as_ref(), "// newer draft\n");
-    assert!(current.diagnostics.is_empty());
-    assert!(Arc::ptr_eq(&original_model, &app.document.snapshot()));
-    app.text_workspace.reset();
-    assert!(app.source_annotation_snapshot().is_none());
-}
-
-#[test]
-fn annotation_snapshot_tracks_real_file_round_trips_without_changing_model() {
-    let mut project = Project::empty();
-    let element = project
-        .add_element(
-            oa_core::Kind::Activity,
-            oa_core::Layer::Oa,
-            "Assess incident",
-            None,
-        )
-        .unwrap();
-    let mut app = App::with_project(project);
-    app.page = Page::Text;
-    app.publish_source_diagnostics(app.source_diagnostics.clone());
-    let model = app.document.snapshot();
-    let entry = app.source_workspace.entry.clone();
-    let fragment = app.document.compiled().index.declarations[&element]
-        .path
-        .clone();
-    assert_ne!(entry, fragment);
-    for path in [&entry, &fragment, &entry] {
-        let _ = app.update(Message::SourceFile(path.clone()));
-        let current = app.source_annotation_snapshot().unwrap();
-        assert_eq!(current.path, path);
-        assert_eq!(
-            current.source.as_ref(),
-            app.source_workspace.files[path].text
-        );
-        assert!(Arc::ptr_eq(&current.source, &app.source_snapshot));
-        assert!(Arc::ptr_eq(&model, &app.document.snapshot()));
-    }
-}

crates/oa-desktop/src/behavior.rs

@@ -14,11 +14,11 @@ use iced::{
 };
 use oa_core::*;
 use std::collections::BTreeMap;
-#[cfg(test)]
-mod contextual_source_tests;
 pub(crate) mod creation;
 pub(crate) mod scenario;
-pub(crate) mod source_draft;
+// Projection acceptance precedes the coordinated scenario renderer integration.
+#[cfg(test)]
+mod scenario_lifecycle;
 pub(crate) mod state_canvas;
 pub(crate) mod state_edit;
 pub(crate) mod state_menu;
@@ -742,29 +742,6 @@ pub enum Event {
     Submit,
 }
 impl Event {
-    pub fn is_source_back(&self) -> bool {
-        matches!(
-            self,
-            Self::Creation(creation::Event::Source(source_draft::Event::Edit(
-                _,
-                source_draft::Edit::Back
-            ))) | Self::Scenario(scenario::Event::Source(source_draft::Event::Edit(
-                _,
-                source_draft::Edit::Back
-            ))) | Self::Topology(topology::Event::Source(source_draft::Event::Edit(
-                _,
-                source_draft::Edit::Back
-            )))
-        )
-    }
-    pub fn is_source(&self) -> bool {
-        matches!(
-            self,
-            Self::Creation(creation::Event::Source(_))
-                | Self::Scenario(scenario::Event::Source(_))
-                | Self::Topology(topology::Event::Source(_))
-        )
-    }
     pub fn starts_form(&self) -> bool {
         matches!(
             self,
@@ -895,18 +872,6 @@ impl State {
 
     /// Clear the active form after its prepared command commits successfully.
     /// Rejected commands must leave the form available for repair and retry.
-    pub fn source_active(&self) -> bool {
-        self.creation.source_active()
-            || self.scenario.source_active()
-            || self.topology.source_active()
-    }
-    pub fn source_open(&self) -> bool {
-        self.creation.source_open() || self.scenario.source_open() || self.topology.source_open()
-    }
-    pub fn source_back(&mut self) -> bool {
-        self.creation.source_back() || self.scenario.source_back() || self.topology.source_back()
-    }
-
     pub fn acknowledge_commit(&mut self) {
         self.creation.acknowledge_commit();
         self.topology.acknowledge_commit();
@@ -954,40 +919,6 @@ pub fn view(app: &App) -> Element<'_, Message> {
     if let Some(card) = app.behavior.creation.view(p) {
         return card.map(|event| Message::Behavior(Event::Creation(event)));
     }
-    if let Some(owner) = app.behavior.pending_owner() {
-        let kind = p.elements.get(&owner).map(oa_core::Element::kind);
-        let unavailable = p.layer_of(owner) != Some(app.layer)
-            || (app.behavior.scenario.pending_owner().is_some() && kind != Some(Kind::Scenario))
-            || (app.behavior.topology.pending_owner().is_some()
-                && !matches!(kind, Some(Kind::Process | Kind::FunctionalChain)));
-        if unavailable {
-            let mut out=column![text("The pending behavior owner is unavailable").size(20),text("Your inputs are retained. Return from the source form or cancel this parent draft before choosing another behavior.").size(13)].spacing(12);
-            if let Some(name) = app
-                .behavior
-                .scenario
-                .pending_name()
-                .or_else(|| app.behavior.topology.pending_name())
-            {
-                out =
-                    out.push(text(format!("Pending consumer name: {}", short(name, 80))).size(14));
-            }
-            if let Some(child) = app.behavior.scenario.source_view(p) {
-                out = out.push(child.map(|e| Message::Behavior(Event::Scenario(e))));
-            } else if let Some(child) = app.behavior.topology.source_view(p) {
-                out = out.push(child.map(|e| Message::Behavior(Event::Topology(e))));
-            } else {
-                let cancel = if app.behavior.scenario.pending_owner().is_some() {
-                    Event::Scenario(scenario::Event::Cancel)
-                } else if app.behavior.topology.pending_owner().is_some() {
-                    Event::Topology(topology::Event::Cancel)
-                } else {
-                    Event::States(states::Event::Cancel)
-                };
-                out = out.push(button("Cancel retained draft").on_press(Message::Behavior(cancel)));
-            }
-            return container(out).padding(16).width(Fill).height(Fill).into();
-        }
-    }
     let choices = p
         .elements
         .values()

crates/oa-desktop/src/behavior/creation.rs

@@ -75,7 +75,6 @@ impl Picker {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
-    Source(super::source_draft::Event),
     Open(Layer),
     Choose(Family),
     Name(String),
@@ -98,11 +97,6 @@ struct Browser {
 #[derive(Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
-    #[serde(default)]
-    source: super::source_draft::State,
-    #[serde(default = "Id::new_v4")]
-    invocation: Id,
-
     version: u32,
     document: Id,
     layer: Layer,
@@ -131,17 +125,6 @@ pub struct Created {
 }
 
 impl State {
-    pub fn source_active(&self) -> bool {
-        self.draft.as_ref().is_some_and(|d| d.source.engaged())
-    }
-
-    pub fn source_open(&self) -> bool {
-        self.draft.as_ref().is_some_and(|d| d.source.is_open())
-    }
-    pub fn source_back(&mut self) -> bool {
-        self.draft.as_mut().is_some_and(|d| d.source.back())
-    }
-
     pub fn has_pending(&self) -> bool {
         self.draft.is_some()
     }
@@ -191,49 +174,6 @@ impl State {
             .command(p)
     }
     pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
-        if let Event::Source(event) = event {
-            if self
-                .draft
-                .as_mut()
-                .ok_or("Start the consumer form first.")?
-                .source
-                .dismiss(&event)?
-            {
-                return Ok(None);
-            }
-            let d = self
-                .draft
-                .as_ref()
-                .ok_or("Start the consumer form first.")?;
-            if d.family != Some(Family::Machine) {
-                return Err("This reference does not support staged source creation.".into());
-            }
-            if d.document != p.id {
-                return Err("This behavior draft belongs to another document.".into());
-            }
-            let mut next = d.clone();
-            if let Some(id) = next.source.update(
-                p,
-                super::source_draft::Scope::Machine { layer: d.layer },
-                d.invocation,
-                event,
-            )? {
-                next.owner = Some(id);
-                let preview = next
-                    .source
-                    .preview(p, next.owner)?
-                    .ok_or("New owner preview is missing.")?;
-                if !eligible(&preview, next.layer, Picker::Owner, id) {
-                    return Err("This participant cannot own the machine.".into());
-                }
-            }
-            self.draft = Some(next);
-            return Ok(None);
-        }
-        if self.source_open() && !matches!(&event, Event::Cancel) {
-            return Err("Use the new source or go Back before editing the parent form.".into());
-        }
-
         match event {
             Event::Cancel => {
                 self.draft = None;
@@ -244,8 +184,6 @@ impl State {
                     return Err("Create or cancel the pending behavior first.".into());
                 }
                 self.draft = Some(Draft {
-                    source: Default::default(),
-                    invocation: Id::new_v4(),
                     version: 1,
                     document: p.id,
                     layer,
@@ -394,7 +332,7 @@ fn reference_context(p: &Project, e: &Element) -> String {
     };
     format!("{} · {} · {location}", e.kind(), e.alias)
 }
-pub(super) fn reference_label(p: &Project, id: Id) -> String {
+fn reference_label(p: &Project, id: Id) -> String {
     p.elements
         .get(&id)
         .map(|e| format!("{} · {}", e.name, reference_context(p, e)))
@@ -402,15 +340,6 @@ pub(super) fn reference_label(p: &Project, id: Id) -> String {
 }
 impl Draft {
     fn command(&self, p: &Project) -> Result<Command, String> {
-        self.source.check_scope(
-            super::source_draft::Scope::Machine { layer: self.layer },
-            self.owner,
-        )?;
-        let preview = self.source.preview(p, self.owner)?;
-        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
-        self.source.combine(p, self.owner, command)
-    }
-    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
         if self.document != p.id {
             return Err("This draft belongs to another document.".into());
         }
@@ -546,21 +475,6 @@ impl State {
         p: &'a Project,
     ) -> Option<UiElement<'a, Event, iced::Theme, R>> {
         let d = self.draft.as_ref()?;
-        if let Some(view) = d.source.view(p) {
-            return Some(
-                column![
-                    text(format!(
-                        "State machine name: {}",
-                        crate::views::short(&d.name, 60)
-                    ))
-                    .size(12),
-                    view.map(Event::Source)
-                ]
-                .spacing(6)
-                .height(Fill)
-                .into(),
-            );
-        }
         let mut fields = column![].spacing(10);
         let title = if let Some(family) = d.family {
             fields = fields.push(
@@ -574,7 +488,7 @@ impl State {
                 Family::Sequence => {
                     fields = fields.push(
                         text(format!(
-                            "Owned by the {} layer root. Add work and exchange contributions after creation.",
+                            "Owned by the {} layer root. Involve existing work after creation.",
                             d.layer
                         ))
                         .size(12),
@@ -617,17 +531,7 @@ impl State {
                     }
                 }
                 Family::Machine => {
-                    if let Some(label) = d.source.label(d.owner) {
-                        fields = fields.push(text(label).size(13)).push(text("Create and open commits the new owner and machine together, including the first view only when selected.").size(12));
-                    }
                     fields = fields.push(picker_view(p, d, Picker::Owner));
-                    fields = fields.push(
-                        button("Create new owner…")
-                            .on_press(Event::Source(super::source_draft::Event::Open(
-                                d.invocation,
-                            )))
-                            .padding(7),
-                    );
                     fields = fields.push(
                         checkbox(d.first_view)
                             .label("Create the first state view")
@@ -640,9 +544,9 @@ impl State {
         } else {
             for family in [Family::Sequence, Family::Scenario, Family::Machine] {
                 let purpose = match family {
-                    Family::Sequence => "A path through work and exchanges",
+                    Family::Sequence => "A path through existing work and exchanges",
                     Family::Scenario => "Ordered interactions from an explicit viewpoint",
-                    Family::Machine => "States and modes of an explicitly chosen participant",
+                    Family::Machine => "States and modes of an existing participant",
                 };
                 fields = fields.push(
                     button(
@@ -694,9 +598,7 @@ fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
         Picker::Owner => d.owner,
         Picker::Context => d.context,
     };
-    let staged_owner = picker == Picker::Owner && d.source.label(selected).is_some();
     let title = match picker {
-        Picker::Owner if staged_owner => "Or choose an existing participant",
         Picker::Owner => "Owned by participant",
         Picker::Context => "Scenario context · optional",
     };
@@ -707,17 +609,14 @@ fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
             .padding(6)
     ]
     .spacing(5);
-    if let Some(id) = selected
-        && !staged_owner
-    {
+    if let Some(id) = selected {
         out = out.push(text(format!("Selected: {}", reference_label(p, id))).size(12));
     } else if picker == Picker::Context {
         out = out.push(text("No context selected").size(12));
     }
     if options.is_empty() {
         out = out.push(text(match picker {
-            Picker::Owner if staged_owner => "No existing participants match this search. The new owner above remains selected.",
-            Picker::Owner => "No matching participant. Refine the search or choose Create new owner.",
+            Picker::Owner => "No matching participant. Refine the search, or cancel and create a participant in Architecture first.",
             Picker::Context => "No matching context. Refine the search, or leave this optional reference empty.",
         }).size(12));
     }

crates/oa-desktop/src/behavior/scenario.rs

@@ -94,7 +94,6 @@ impl std::fmt::Display for CanvasTool {
 }
 #[derive(Debug, Clone)]
 pub enum CanvasEvent {
-    First(Context, Tool),
     Scrolled(Context, ScrollArea, iced::Vector),
     Restored(Context, Id, ScrollArea, iced::Vector),
     Viewport(Context, Size),
@@ -133,8 +132,7 @@ pub enum ScrollArea {
 impl CanvasEvent {
     pub fn context(&self) -> Context {
         match self {
-            Self::First(context, _)
-            | Self::Scrolled(context, _, _)
+            Self::Scrolled(context, _, _)
             | Self::Restored(context, ..)
             | Self::Viewport(context, _)
             | Self::Zoom(context, _)
@@ -164,7 +162,6 @@ impl std::fmt::Display for Operator {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
-    Source(super::source_draft::Event),
     Start(Id, Tool),
     Cancel,
     Submit,
@@ -243,13 +240,6 @@ struct CallChoiceContext {
 #[derive(Clone, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
-    #[serde(default)]
-    source: super::source_draft::State,
-    #[serde(default = "Id::new_v4")]
-    invocation: Id,
-    #[serde(default)]
-    source_origin: Option<(Id, oa_core::Element)>,
-
     owner: Id,
     parent: Id,
     before: Option<Id>,
@@ -282,28 +272,6 @@ struct Draft {
     choice_page: usize,
 }
 impl State {
-    pub(super) fn pending_name(&self) -> Option<&str> {
-        self.draft.as_ref().map(|d| d.name.as_str())
-    }
-    pub(super) fn source_view<'a>(&'a self, p: &'a Project) -> Option<iced::Element<'a, Event>> {
-        self.draft
-            .as_ref()?
-            .source
-            .view(p)
-            .map(|v| v.map(Event::Source))
-    }
-
-    pub fn source_active(&self) -> bool {
-        self.draft.as_ref().is_some_and(|d| d.source.engaged())
-    }
-
-    pub fn source_open(&self) -> bool {
-        self.draft.as_ref().is_some_and(|d| d.source.is_open())
-    }
-    pub fn source_back(&mut self) -> bool {
-        self.draft.as_mut().is_some_and(|d| d.source.back())
-    }
-
     pub(crate) fn enter(&mut self, document: Id, owner: Id) {
         if self.presentation.identity != Some((document, owner)) {
             self.presentation = workspace::Presentation {
@@ -484,16 +452,8 @@ impl State {
         }
         cached.as_ref().unwrap().1.clone()
     }
-    pub(crate) fn created_selection(&self, p: &Project, command: &Command) -> Option<Id> {
+    pub(crate) fn created_selection(&self, command: &Command) -> Option<Id> {
         let draft = self.draft.as_ref()?;
-        if self
-            .draft
-            .as_ref()
-            .is_some_and(|d| d.source.label(d.target).is_some())
-            && self.prepare_pending(p).ok().as_ref() != Some(command)
-        {
-            return None;
-        }
         fn created(command: &Command, parent: Id) -> Option<Id> {
             match command {
                 Command::CreateElement(element) if element.parent == Some(parent) => {
@@ -608,61 +568,6 @@ impl State {
     }
 
     pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
-        if let Event::Source(event) = event {
-            if self
-                .draft
-                .as_mut()
-                .ok_or("Start the consumer form first.")?
-                .source
-                .dismiss(&event)?
-            {
-                return Ok(None);
-            }
-            let d = self
-                .draft
-                .as_ref()
-                .ok_or("Start the consumer form first.")?;
-            if d.tool != Tool::Lifeline {
-                return Err("This reference does not support staged source creation.".into());
-            }
-            if d.source_origin.as_ref().is_some_and(|(document, owner)| {
-                *document != p.id || p.elements.get(&d.owner) != Some(owner)
-            }) {
-                return Err("The original consumer changed. Cancel and reopen its form; the current draft is retained.".into());
-            }
-            if d.source_origin.is_none() && d.source.engaged() {
-                return Err("The recovered source draft has no original document binding. Go Back or cancel it.".into());
-            }
-            let mut next = d.clone();
-            if next.source_origin.is_none() && matches!(&event, super::source_draft::Event::Open(_))
-            {
-                next.source_origin = Some((
-                    p.id,
-                    p.elements
-                        .get(&d.owner)
-                        .ok_or("The consumer owner no longer exists.")?
-                        .clone(),
-                ));
-            }
-            if let Some(id) = next.source.update(
-                p,
-                super::source_draft::Scope::Lifeline {
-                    owner: d.owner,
-                    viewpoint: viewpoint(p, d.owner),
-                },
-                d.invocation,
-                event,
-            )? {
-                next.target = Some(id);
-                next.command(p)?;
-            }
-            self.draft = Some(next);
-            return Ok(None);
-        }
-        if self.source_open() && !matches!(&event, Event::Cancel) {
-            return Err("Use the new source or go Back before editing the parent form.".into());
-        }
-
         if self.draft.is_some() && matches!(&event, Event::Start(..)) {
             return Err(PENDING_DRAFT.into());
         }
@@ -672,9 +577,6 @@ impl State {
                     return Err("Choose a scenario.".into());
                 }
                 self.draft = Some(Draft {
-                    source: Default::default(),
-                    invocation: Id::new_v4(),
-                    source_origin: Some((p.id, p.elements[&owner].clone())),
                     owner,
                     parent: owner,
                     before: None,
@@ -1038,14 +940,7 @@ fn valid_body_choice(p: &Project, owner: Id, body: OccurrenceBody) -> bool {
     execute_batch(p, &[Command::CreateElement(e)]).is_ok()
 }
 fn sources(p: &Project, d: &Draft) -> Vec<Choice> {
-    let Some(owner) = p
-        .elements
-        .get(&d.owner)
-        .filter(|e| e.kind() == Kind::Scenario)
-    else {
-        return vec![];
-    };
-    let layer = owner.layer();
+    let layer = p.elements[&d.owner].layer();
     let mut values: Vec<_> = p
         .elements
         .values()
@@ -1361,28 +1256,6 @@ impl Draft {
         e
     }
     fn command(&self, p: &Project) -> Result<Command, String> {
-        if self.source.engaged()
-            && self.source_origin.as_ref().is_none_or(|(document, owner)| {
-                *document != p.id || p.elements.get(&self.owner) != Some(owner)
-            })
-        {
-            return Err("The original consumer document or owner changed. Cancel and reopen its form; your draft is retained.".into());
-        }
-        self.source.check_scope(
-            super::source_draft::Scope::Lifeline {
-                owner: self.owner,
-                viewpoint: viewpoint(p, self.owner),
-            },
-            self.target,
-        )?;
-        let preview = self.source.preview(p, self.target)?;
-        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
-        self.source.combine(p, self.target, command)
-    }
-    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
-        if p.elements.get(&self.owner).map(oa_core::Element::kind) != Some(Kind::Scenario) {
-            return Err("The scenario no longer exists. Cancel or restore its owner.".into());
-        }
         if !parents(p, self.owner).iter().any(|c| c.id == self.parent) {
             return Err("Choose this scenario or one of its operands as destination.".into());
         }
@@ -1393,8 +1266,6 @@ impl Draft {
             .unwrap_or(self.tool.label());
         let name = if self.name.trim().is_empty() {
             default
-        } else if self.source.label(self.target).is_some() {
-            self.name.as_str()
         } else {
             self.name.trim()
         };

crates/oa-desktop/src/behavior/scenario/workspace.rs

@@ -168,11 +168,6 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
         .wrap(),
         text(if pending {
             "Pending form · the highlighted sequence position is retained".to_owned()
-        } else if !p.children(owner).any(|e| e.kind() == Kind::Lifeline) {
-            "Start with a lifeline representing existing or explicitly new work / participants."
-                .into()
-        } else if !p.children(owner).any(|e| e.kind() == Kind::Occurrence) {
-            "Choose a first message, action or another tool; no occurrence is selected yet.".into()
         } else {
             let guidance = match tool {
                 CanvasTool::Message(_) => {
@@ -191,32 +186,6 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
         .size(11)
     ]
     .spacing(6);
-    if !pending {
-        if !p.children(owner).any(|e| e.kind() == Kind::Lifeline) {
-            header = header.push(
-                row![
-                    text(format!("No lifelines · {:?}", viewpoint(p, owner))).size(12),
-                    button("Add first lifeline").on_press_maybe(clean.then_some({
-                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Lifeline))
-                    }))
-                ]
-                .spacing(8),
-            );
-        } else if !p.children(owner).any(|e| e.kind() == Kind::Occurrence) {
-            header = header.push(
-                row![
-                    text("No occurrences yet").size(12),
-                    button("Add first message").on_press_maybe(clean.then_some({
-                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Message))
-                    })),
-                    button("Add first action").on_press_maybe(clean.then_some({
-                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Action))
-                    }))
-                ]
-                .spacing(8),
-            );
-        }
-    }
     if limited {
         header = header
             .push(text("Minimum zoom reached · scroll to see the remaining scenario.").size(11));
@@ -326,301 +295,272 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
         .as_ref()
         .filter(|d| d.owner == owner)
     {
-        if let Some(child) = d.source.view(p) {
-            form_panel = column![
-                text(format!(
-                    "Consumer name: {}",
-                    crate::views::short(&d.name, 60)
-                ))
-                .size(12),
-                child.map(|e| event(Event::Source(e)))
-            ]
-            .spacing(6)
-            .height(Fill)
-            .into();
-        } else {
-            let mut form = column![
-                text(d.tool.label()).size(16),
-                text_input("Name (defaults to selected source)", &d.name)
-                    .on_input(|s| event(Event::Name(s)))
-                    .padding(9)
-                    .size(12)
-            ]
-            .spacing(9);
-            if d.tool != Tool::Lifeline {
-                form = form.push(label(format!(
-                    "Insert: {}",
-                    slot_label(
-                        p,
-                        Slot {
-                            parent: d.parent,
-                            before: d.before
-                        }
-                    )
-                )));
-                if d.before.is_some() {
-                    form = form.push(
-                        button("Append to this sequence instead")
-                            .on_press(event(Event::AppendInstead)),
-                    );
-                }
-                form = form.push(picker(
-                    parents(p, owner),
-                    Some(d.parent),
-                    "Destination sequence / operand…",
-                    Event::Parent,
-                ));
-            }
-            if matches!(
-                d.tool,
-                Tool::Lifeline | Tool::Reuse | Tool::Action | Tool::Observation
-            ) {
-                form = form.push(picker(
-                    sources(p, d),
-                    d.target,
-                    "Choose a named source…",
-                    Event::Target,
-                ));
-            }
-            if d.tool == Tool::Lifeline {
-                if let Some(title) = d.source.label(d.target) {
-                    form = form.push(label(title)).push(label(
-                        "Create commits one new source and this lifeline together.",
-                    ));
-                }
-                if viewpoint(p, owner) != ScenarioViewpoint::MixedLegacy {
-                    form = form.push(button("Create new source…").on_press(event(Event::Source(
-                        super::super::source_draft::Event::Open(d.invocation),
-                    ))));
-                } else {
-                    form=form.push(label("New source creation requires a strict viewpoint. Existing sources remain available."));
-                }
-            }
-            if d.tool == Tool::Message {
+        let mut form = column![
+            text(d.tool.label()).size(16),
+            text_input("Name (defaults to selected source)", &d.name)
+                .on_input(|s| event(Event::Name(s)))
+                .padding(9)
+                .size(12)
+        ]
+        .spacing(9);
+        if d.tool != Tool::Lifeline {
+            form = form.push(label(format!(
+                "Insert: {}",
+                slot_label(
+                    p,
+                    Slot {
+                        parent: d.parent,
+                        before: d.before
+                    }
+                )
+            )));
+            if d.before.is_some() {
                 form = form.push(
-                    pick_list(
-                        vec![
-                            MessageStyle::Asynchronous,
-                            MessageStyle::Call,
-                            MessageStyle::CallReply,
-                            MessageStyle::Reply,
-                            MessageStyle::Create,
-                            MessageStyle::Delete,
-                            MessageStyle::Timer,
-                        ],
-                        Some(d.style),
-                        |style| event(Event::Style(style)),
-                    )
-                    .width(Fill)
-                    .padding(9)
-                    .text_size(12),
+                    button("Append to this sequence instead").on_press(event(Event::AppendInstead)),
                 );
-                if d.style == MessageStyle::Reply {
-                    form = form.push(bounded_picker(
-                        app.behavior.scenario.call_choices(p, context, d),
-                        d,
-                        d.call,
-                        "Choose the earlier call…",
-                        Event::Call,
-                    ));
-                    if d.call.is_some() {
-                        form = form.push(label(
+            }
+            form = form.push(picker(
+                parents(p, owner),
+                Some(d.parent),
+                "Destination sequence / operand…",
+                Event::Parent,
+            ));
+        }
+        if matches!(
+            d.tool,
+            Tool::Lifeline | Tool::Reuse | Tool::Action | Tool::Observation
+        ) {
+            form = form.push(picker(
+                sources(p, d),
+                d.target,
+                "Choose a named source…",
+                Event::Target,
+            ));
+        }
+        if d.tool == Tool::Message {
+            form = form.push(
+                pick_list(
+                    vec![
+                        MessageStyle::Asynchronous,
+                        MessageStyle::Call,
+                        MessageStyle::CallReply,
+                        MessageStyle::Reply,
+                        MessageStyle::Create,
+                        MessageStyle::Delete,
+                        MessageStyle::Timer,
+                    ],
+                    Some(d.style),
+                    |style| event(Event::Style(style)),
+                )
+                .width(Fill)
+                .padding(9)
+                .text_size(12),
+            );
+            if d.style == MessageStyle::Reply {
+                form = form.push(bounded_picker(
+                    app.behavior.scenario.call_choices(p, context, d),
+                    d,
+                    d.call,
+                    "Choose the earlier call…",
+                    Event::Call,
+                ));
+                if d.call.is_some() {
+                    form = form.push(label(
                         "Reply reuses the call exchange in reverse and retains its correlation.",
                     ));
-                    }
-                } else if d.style != MessageStyle::Timer {
-                    form = form.push(bounded_picker(
-                        exchanges(p, d),
-                        d,
-                        d.exchange,
-                        "Choose the exchange…",
-                        Event::Exchange,
-                    ));
-                    form = form.push(label(
-                        "Apply checks that the message is valid at this insertion position.",
-                    ));
                 }
-                form = form.push(picker(
-                    d.line_choices(p, true),
-                    d.sender,
-                    "Sending lifeline…",
-                    Event::Sender,
+            } else if d.style != MessageStyle::Timer {
+                form = form.push(bounded_picker(
+                    exchanges(p, d),
+                    d,
+                    d.exchange,
+                    "Choose the exchange…",
+                    Event::Exchange,
                 ));
-                if d.style != MessageStyle::Timer {
-                    form = form.push(picker(
-                        d.line_choices(p, false),
-                        d.receiver,
-                        "Receiving lifeline…",
-                        Event::Receiver,
-                    ));
-                }
-                if d.style == MessageStyle::Timer {
-                    form = form.push(
-                        text_input("Duration / deadline, e.g. 30 s", &d.expression)
-                            .on_input(|s| event(Event::Expression(s)))
-                            .padding(9)
-                            .size(12),
-                    );
-                }
-                if p.layer_of(owner) == Some(Layer::Sa)
-                    && viewpoint(p, owner) == ScenarioViewpoint::BoundaryInterface
-                    && matches!(
-                        d.style,
-                        MessageStyle::Call | MessageStyle::CallReply | MessageStyle::Asynchronous
-                    )
-                {
-                    form = form.push(
-                        iced::widget::checkbox(d.operation.is_some())
-                            .label("Invoke a specific interface operation")
-                            .on_toggle(|enabled| event(Event::OperationIntent(enabled))),
-                    );
-                    if let Some(operation) = &d.operation {
-                        form = form
-                            .push(bounded_picker(
-                                crate::data_values::operation_choices(p, &d.proposed_message(p)),
-                                d,
-                                operation.allocation,
-                                "Choose the exact interface operation allocation…",
-                                Event::Operation,
-                            ))
-                            .push(
-                                button("Keep operation unresolved")
-                                    .on_press(event(Event::ClearOperation)),
-                            );
-                        if let Some(id) = operation.allocation {
-                            form = form.push(label(crate::data_values::operation_identity(p, id)));
-                        }
-                    }
-                }
-                if let Some(description) =
-                    crate::data_values::operation_label(p, &d.proposed_message(p))
-                {
-                    form = form.push(label(description));
-                }
-                match d.signature(p) {
-                    Ok(Some(exchange)) => form = form.push(value_panel(p, d, &exchange)),
-                    Err(problem) => {
-                        form = form.push(label(problem));
-                        for (key, expression) in d.authored_values() {
-                            form = form
-                                .push(
-                                    text(format!(
-                                        "Retained value · {} / {}",
-                                        key.path
-                                            .iter()
-                                            .map(|id| p.named(*id))
-                                            .collect::<Vec<_>>()
-                                            .join(" → "),
-                                        p.named(key.field)
-                                    ))
-                                    .size(11),
-                                )
-                                .push(
-                                    text_input("Value expression", expression)
-                                        .on_input({
-                                            let key = key.clone();
-                                            move |raw| event(Event::Value(key.clone(), raw))
-                                        })
-                                        .padding(8)
-                                        .size(12),
-                                );
-                        }
-                    }
-                    Ok(None) => {}
-                }
-                if d.style == MessageStyle::CallReply {
-                    form=form.push(label("Creates the call and reversed, correlated reply together in one undoable operation."));
-                }
-            }
-            if matches!(d.tool, Tool::Action | Tool::Observation) {
-                form = form.push(picker(
-                    lines(p, owner),
-                    d.sender,
-                    "Observed lifeline…",
-                    Event::Sender,
-                ));
-            }
-            if d.tool == Tool::Reuse
-                && let Some(target) = d.target
-            {
-                for line in lines(p, target) {
-                    let referenced = line.id;
-                    let compatible: Vec<_> = lines(p, owner)
-                        .into_iter()
-                        .filter(|c| {
-                            compatible_binding(p, referenced, c.id)
-                                && !d
-                                    .bindings
-                                    .iter()
-                                    .any(|(r, l)| *r != referenced && *l == c.id)
-                        })
-                        .collect();
-                    if compatible.is_empty() {
-                        form = form.push(label(format!(
-                            "Add a compatible local lifeline before binding '{}'.",
-                            p.named(referenced)
-                        )));
-                    }
-                    form = form
-                        .push(label(format!("Bind {}", p.named(referenced))))
-                        .push(picker(
-                            compatible,
-                            d.bindings.get(&referenced).copied(),
-                            "Compatible local lifeline…",
-                            move |c| Event::Binding(referenced, c),
-                        ));
-                }
                 form = form.push(label(
-                    "Bindings are explicit, one-to-one and refer to existing lifelines.",
+                    "Apply checks that the message is valid at this insertion position.",
                 ));
             }
-            if d.tool == Tool::Fragment {
+            form = form.push(picker(
+                d.line_choices(p, true),
+                d.sender,
+                "Sending lifeline…",
+                Event::Sender,
+            ));
+            if d.style != MessageStyle::Timer {
+                form = form.push(picker(
+                    d.line_choices(p, false),
+                    d.receiver,
+                    "Receiving lifeline…",
+                    Event::Receiver,
+                ));
+            }
+            if d.style == MessageStyle::Timer {
                 form = form.push(
-                    pick_list(
-                        vec![
-                            Operator(FragmentOperator::Alternative),
-                            Operator(FragmentOperator::Parallel),
-                            Operator(FragmentOperator::Loop),
-                            Operator(FragmentOperator::Optional),
-                        ],
-                        Some(Operator(d.operator)),
-                        |o| event(Event::Operator(o)),
-                    )
-                    .padding(9)
-                    .text_size(12)
-                    .width(Fill),
+                    text_input("Duration / deadline, e.g. 30 s", &d.expression)
+                        .on_input(|s| event(Event::Expression(s)))
+                        .padding(9)
+                        .size(12),
                 );
-                if d.operator != FragmentOperator::Parallel {
-                    form = form.push(
-                        text_input("Condition / loop guard", &d.expression)
-                            .on_input(|s| event(Event::Expression(s)))
-                            .padding(9)
-                            .size(12),
-                    );
-                }
-                if d.operator == FragmentOperator::Alternative {
-                    form = form.push(
-                        text_input("Second alternative guard", &d.second_guard)
-                            .on_input(|s| event(Event::SecondGuard(s)))
-                            .padding(9)
-                            .size(12),
-                    );
-                }
-                form=form.push(label("Creates the fragment with its operands. Choose an operand as destination when adding messages or actions."));
             }
-            let readiness = d.command(p);
-            if let Err(error) = &readiness {
-                form = form.push(label(error.clone()));
+            if p.layer_of(owner) == Some(Layer::Sa)
+                && viewpoint(p, owner) == ScenarioViewpoint::BoundaryInterface
+                && matches!(
+                    d.style,
+                    MessageStyle::Call | MessageStyle::CallReply | MessageStyle::Asynchronous
+                )
+            {
+                form = form.push(
+                    iced::widget::checkbox(d.operation.is_some())
+                        .label("Invoke a specific interface operation")
+                        .on_toggle(|enabled| event(Event::OperationIntent(enabled))),
+                );
+                if let Some(operation) = &d.operation {
+                    form = form
+                        .push(bounded_picker(
+                            crate::data_values::operation_choices(p, &d.proposed_message(p)),
+                            d,
+                            operation.allocation,
+                            "Choose the exact interface operation allocation…",
+                            Event::Operation,
+                        ))
+                        .push(
+                            button("Keep operation unresolved")
+                                .on_press(event(Event::ClearOperation)),
+                        );
+                    if let Some(id) = operation.allocation {
+                        form = form.push(label(crate::data_values::operation_identity(p, id)));
+                    }
+                }
+            }
+            if let Some(description) =
+                crate::data_values::operation_label(p, &d.proposed_message(p))
+            {
+                form = form.push(label(description));
+            }
+            match d.signature(p) {
+                Ok(Some(exchange)) => form = form.push(value_panel(p, d, &exchange)),
+                Err(problem) => {
+                    form = form.push(label(problem));
+                    for (key, expression) in d.authored_values() {
+                        form = form
+                            .push(
+                                text(format!(
+                                    "Retained value · {} / {}",
+                                    key.path
+                                        .iter()
+                                        .map(|id| p.named(*id))
+                                        .collect::<Vec<_>>()
+                                        .join(" → "),
+                                    p.named(key.field)
+                                ))
+                                .size(11),
+                            )
+                            .push(
+                                text_input("Value expression", expression)
+                                    .on_input({
+                                        let key = key.clone();
+                                        move |raw| event(Event::Value(key.clone(), raw))
+                                    })
+                                    .padding(8)
+                                    .size(12),
+                            );
+                    }
+                }
+                Ok(None) => {}
+            }
+            if d.style == MessageStyle::CallReply {
+                form=form.push(label("Creates the call and reversed, correlated reply together in one undoable operation."));
             }
-            let footer = row![
-                button("Create")
-                    .padding(9)
-                    .on_press_maybe(readiness.is_ok().then_some(event(Event::Submit))),
-                action("Cancel", event(Event::Cancel))
-            ]
-            .spacing(7);
-            form_panel = editor_panel(footer.into(), form.into());
         }
+        if matches!(d.tool, Tool::Action | Tool::Observation) {
+            form = form.push(picker(
+                lines(p, owner),
+                d.sender,
+                "Observed lifeline…",
+                Event::Sender,
+            ));
+        }
+        if d.tool == Tool::Reuse
+            && let Some(target) = d.target
+        {
+            for line in lines(p, target) {
+                let referenced = line.id;
+                let compatible: Vec<_> = lines(p, owner)
+                    .into_iter()
+                    .filter(|c| {
+                        compatible_binding(p, referenced, c.id)
+                            && !d
+                                .bindings
+                                .iter()
+                                .any(|(r, l)| *r != referenced && *l == c.id)
+                    })
+                    .collect();
+                if compatible.is_empty() {
+                    form = form.push(label(format!(
+                        "Add a compatible local lifeline before binding '{}'.",
+                        p.named(referenced)
+                    )));
+                }
+                form = form
+                    .push(label(format!("Bind {}", p.named(referenced))))
+                    .push(picker(
+                        compatible,
+                        d.bindings.get(&referenced).copied(),
+                        "Compatible local lifeline…",
+                        move |c| Event::Binding(referenced, c),
+                    ));
+            }
+            form = form.push(label(
+                "Bindings are explicit, one-to-one and refer to existing lifelines.",
+            ));
+        }
+        if d.tool == Tool::Fragment {
+            form = form.push(
+                pick_list(
+                    vec![
+                        Operator(FragmentOperator::Alternative),
+                        Operator(FragmentOperator::Parallel),
+                        Operator(FragmentOperator::Loop),
+                        Operator(FragmentOperator::Optional),
+                    ],
+                    Some(Operator(d.operator)),
+                    |o| event(Event::Operator(o)),
+                )
+                .padding(9)
+                .text_size(12)
+                .width(Fill),
+            );
+            if d.operator != FragmentOperator::Parallel {
+                form = form.push(
+                    text_input("Condition / loop guard", &d.expression)
+                        .on_input(|s| event(Event::Expression(s)))
+                        .padding(9)
+                        .size(12),
+                );
+            }
+            if d.operator == FragmentOperator::Alternative {
+                form = form.push(
+                    text_input("Second alternative guard", &d.second_guard)
+                        .on_input(|s| event(Event::SecondGuard(s)))
+                        .padding(9)
+                        .size(12),
+                );
+            }
+            form=form.push(label("Creates the fragment with its operands. Choose an operand as destination when adding messages or actions."));
+        }
+        let readiness = d.command(p);
+        if let Err(error) = &readiness {
+            form = form.push(label(error.clone()));
+        }
+        let footer = row![
+            button("Create")
+                .padding(9)
+                .on_press_maybe(readiness.is_ok().then_some(event(Event::Submit))),
+            action("Cancel", event(Event::Cancel))
+        ]
+        .spacing(7);
+        form_panel = editor_panel(footer.into(), form.into());
     }
     workspace_layout(header.into(), details, canvas, form_panel, pending)
 }
@@ -709,7 +649,6 @@ fn canvas_pane<'a, R: iced::advanced::text::Renderer + 'a>(
                 .width(Fill)
                 .height(Fill),
         ))
-        // A new owner/document needs its first measurement even at the same size.
         .key((context.document, context.scenario))
         .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
         .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -342,7 +342,7 @@ fn scenario_workspace_fit_uses_measured_inner_viewport_and_rejects_nonfinite_inp
 }
 
 #[test]
-fn scenario_workspace_fit_reobserves_same_sized_owner_and_document_changes() {
+fn scenario_workspace_same_size_owner_and_document_changes_remeasure_fit_viewport() {
     use super::super::direct_tests::{navigation_event, navigation_fixture};
     let (project, [a, b, _], [reference, _, _]) = navigation_fixture();
     let mut app = App::with_project(project.clone());
@@ -358,14 +358,13 @@ fn scenario_workspace_fit_reobserves_same_sized_owner_and_document_changes() {
     );
     let mut tree = widget::Tree::new(view.as_widget());
     redraw(&mut view, &mut tree, size, &mut app);
-    let (_, first) = geometry(&mut view, &mut tree, size);
-    let measured = first.scrolls["scenario-canvas"].0.size();
-    assert_eq!(app.behavior.scenario.presentation.viewport, Some(measured));
+    let first_viewport = app.behavior.scenario.presentation.viewport.unwrap();
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
+    assert!(app.behavior.scenario.presentation.scale(graph) < 1.);
 
-    let accepted = app.document.snapshot();
     navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
     assert_eq!(app.scenario_context().unwrap().scenario, b);
-    assert_eq!(app.behavior.scenario.presentation.viewport, None);
+    assert!(app.behavior.scenario.presentation.viewport.is_none());
     view = fixture_view(
         &app.behavior.scenario,
         app.scenario_context().unwrap(),
@@ -374,50 +373,38 @@ fn scenario_workspace_fit_reobserves_same_sized_owner_and_document_changes() {
     );
     tree.diff(view.as_widget());
     redraw(&mut view, &mut tree, size, &mut app);
-    let (_, second) = geometry(&mut view, &mut tree, size);
-    assert_eq!(second.scrolls["scenario-canvas"].0.size(), measured);
-    assert_eq!(app.behavior.scenario.presentation.viewport, Some(measured));
+    assert_eq!(
+        app.behavior.scenario.presentation.viewport,
+        Some(first_viewport)
+    );
     navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
     let fitted = app.behavior.scenario.presentation.scale(graph);
-    assert!(
-        fitted < 1.
-            && graph.width * fitted <= measured.width - 16.
-            && graph.height * fitted <= measured.height - 16.
+    assert!(graph.width * fitted <= first_viewport.width - 16.);
+    assert!(graph.height * fitted <= first_viewport.height - 16.);
+
+    let prior_document = app.scenario_context().unwrap().document;
+    app = App::with_project(project);
+    let _ = app.update(Message::Select(b));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    let context = app.scenario_context().unwrap();
+    assert_ne!(context.document, prior_document);
+    assert_eq!(
+        context.scenario, b,
+        "semantic UUID is retained across documents"
     );
+    assert!(app.behavior.scenario.presentation.viewport.is_none());
+    let accepted = app.document.snapshot();
+    view = fixture_view(&app.behavior.scenario, context, false, 68.);
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    assert_eq!(
+        app.behavior.scenario.presentation.viewport,
+        Some(first_viewport)
+    );
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
+    assert_eq!(app.behavior.scenario.presentation.scale(graph), fitted);
     assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
     assert!(!app.document.can_undo());
-
-    let document = app.scenario_context().unwrap().document;
-    let mut replacement = App::with_project(project);
-    let _ = replacement.update(Message::Select(b));
-    let _ = replacement.update(Message::Page(crate::app::Page::Behavior));
-    assert_ne!(replacement.scenario_context().unwrap().document, document);
-    assert_eq!(replacement.behavior.scenario.presentation.viewport, None);
-    let accepted = replacement.document.snapshot();
-    view = fixture_view(
-        &replacement.behavior.scenario,
-        replacement.scenario_context().unwrap(),
-        false,
-        68.,
-    );
-    tree.diff(view.as_widget());
-    redraw(&mut view, &mut tree, size, &mut replacement);
-    let (_, replaced) = geometry(&mut view, &mut tree, size);
-    assert_eq!(replaced.scrolls["scenario-canvas"].0.size(), measured);
-    assert_eq!(
-        replacement.behavior.scenario.presentation.viewport,
-        Some(measured)
-    );
-    navigation_event(&mut replacement, |ctx| CanvasEvent::Zoom(ctx, None));
-    assert_eq!(
-        replacement.behavior.scenario.presentation.scale(graph),
-        fitted
-    );
-    assert!(std::sync::Arc::ptr_eq(
-        &accepted,
-        &replacement.document.snapshot()
-    ));
-    assert!(!replacement.document.can_undo());
 }
 
 #[test]

crates/oa-desktop/src/behavior/scenario_lifecycle.rs

@@ -0,0 +1,283 @@
+//! Read-only lifecycle geometry. Operand screen order is never execution order.
+use oa_core::{FragmentOperator, Id, Kind, MessageKind, OccurrenceBody, Project, SharedBody};
+use std::collections::{BTreeMap, BTreeSet};
+
+/// Maps already recorded by the sequence renderer. Rows carry their owning sequence.
+pub(crate) struct Geometry<'a> {
+    pub rows: &'a BTreeMap<Id, (Id, f32)>,
+    pub scopes: &'a BTreeMap<Id, (f32, f32)>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub(crate) struct Span {
+    pub start: f32,
+    pub end: f32,
+}
+impl Span {
+    fn valid(self) -> bool {
+        self.start.is_finite() && self.end.is_finite() && self.start <= self.end
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Life {
+    Alive,
+    Absent,
+    Unresolved,
+}
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub(crate) struct Interval {
+    pub scope: Id,
+    pub span: Span,
+    pub life: Life,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum MarkerKind {
+    Birth,
+    Death,
+}
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub(crate) struct Marker {
+    pub occurrence: Id,
+    pub scope: Id,
+    pub y: f32,
+    pub kind: MarkerKind,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum UncertaintyReason {
+    Conditional,
+    Repeated,
+    Parallel,
+    MissingGeometry,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Uncertainty {
+    pub scope: Id,
+    pub reason: UncertaintyReason,
+}
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct LaneLifetime {
+    pub lifeline: Id,
+    pub intervals: Vec<Interval>,
+    pub markers: Vec<Marker>,
+    pub uncertainties: Vec<Uncertainty>,
+}
+
+/// Stable lane-ID order; source/model/history and caller-owned geometry are untouched.
+/// An opaque ScenarioUse is a local use, not a caller birth/death contract.
+pub(crate) fn project_lifetimes(
+    project: &Project,
+    scenario: Id,
+    geometry: &Geometry<'_>,
+) -> Vec<LaneLifetime> {
+    if project
+        .elements
+        .get(&scenario)
+        .is_none_or(|e| e.kind() != Kind::Scenario)
+    {
+        return vec![];
+    }
+    project
+        .elements
+        .values()
+        .filter(|e| e.kind() == Kind::Lifeline && e.parent == Some(scenario))
+        .map(|e| {
+            let mut projection = Projection {
+                project,
+                geometry,
+                lane: e.id,
+                visiting: BTreeSet::new(),
+                result: LaneLifetime {
+                    lifeline: e.id,
+                    intervals: vec![],
+                    markers: vec![],
+                    uncertainties: vec![],
+                },
+            };
+            let initial = if projection.contains(scenario, Some(MarkerKind::Birth)) {
+                Life::Unresolved
+            } else {
+                Life::Alive
+            };
+            projection.sequence(scenario, initial);
+            projection.result
+        })
+        .collect()
+}
+
+struct Projection<'a, 'g> {
+    project: &'a Project,
+    geometry: &'a Geometry<'g>,
+    lane: Id,
+    visiting: BTreeSet<Id>,
+    result: LaneLifetime,
+}
+impl Projection<'_, '_> {
+    fn body(&self, id: Id) -> Option<&OccurrenceBody> {
+        match self.project.elements.get(&id)?.shared()? {
+            SharedBody::Occurrence { body, .. } => Some(body),
+            _ => None,
+        }
+    }
+    fn event(&self, id: Id) -> Option<MarkerKind> {
+        match self.body(id)? {
+            OccurrenceBody::Exchange {
+                receiver: Some(line),
+                message_kind,
+                ..
+            } if *line == self.lane => match message_kind {
+                MessageKind::Create => Some(MarkerKind::Birth),
+                MessageKind::Delete => Some(MarkerKind::Death),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+    fn contains(&self, scope: Id, kind: Option<MarkerKind>) -> bool {
+        // Local structural walk only: no guards, iteration simulation or reuse expansion.
+        let mut pending = vec![scope];
+        let mut seen = BTreeSet::new();
+        while let Some(id) = pending.pop() {
+            if !seen.insert(id) {
+                continue;
+            }
+            if self
+                .event(id)
+                .is_some_and(|event| kind.is_none_or(|k| event == k))
+            {
+                return true;
+            }
+            if let Some(steps) = self.project.elements.get(&id).and_then(|e| e.steps()) {
+                pending.extend(steps);
+            }
+            if let Some(OccurrenceBody::Fragment { branches, .. }) = self.body(id) {
+                pending.extend(branches);
+            }
+        }
+        false
+    }
+    fn span(&self, scope: Id) -> Option<Span> {
+        let &(start, end) = self.geometry.scopes.get(&scope)?;
+        let span = Span { start, end };
+        span.valid().then_some(span)
+    }
+    fn uncertain(&mut self, scope: Id, reason: UncertaintyReason) {
+        let value = Uncertainty { scope, reason };
+        if !self.result.uncertainties.contains(&value) {
+            self.result.uncertainties.push(value);
+        }
+    }
+    fn interval(&mut self, scope: Id, start: f32, end: f32, life: Life) {
+        if start < end && start.is_finite() && end.is_finite() {
+            self.result.intervals.push(Interval {
+                scope,
+                span: Span { start, end },
+                life,
+            });
+        }
+    }
+    fn sequence(&mut self, scope: Id, entry: Life) -> Life {
+        let Some(span) = self.span(scope) else {
+            self.uncertain(scope, UncertaintyReason::MissingGeometry);
+            return Life::Unresolved;
+        };
+        if !self.visiting.insert(scope) {
+            self.uncertain(scope, UncertaintyReason::MissingGeometry);
+            return Life::Unresolved;
+        }
+        let steps = self
+            .project
+            .elements
+            .get(&scope)
+            .and_then(|e| e.steps())
+            .cloned()
+            .unwrap_or_default();
+        // A creation directly in this sequence fixes its local birth boundary.
+        // A creation only in a nested operand cannot fix its ancestor's entry.
+        let mut life = if steps
+            .iter()
+            .any(|&id| self.event(id) == Some(MarkerKind::Birth))
+        {
+            Life::Absent
+        } else {
+            entry
+        };
+        let mut cursor = span.start;
+        for id in steps {
+            let event = self.event(id);
+            let fragment = match self.body(id) {
+                Some(OccurrenceBody::Fragment { operator, branches }) => {
+                    Some((*operator, branches.clone()))
+                }
+                _ => None,
+            };
+            if event.is_none() && fragment.is_none() {
+                continue;
+            }
+            let y = self
+                .geometry
+                .rows
+                .get(&id)
+                .filter(|(owner, y)| {
+                    *owner == scope && y.is_finite() && *y >= cursor && *y <= span.end
+                })
+                .map(|(_, y)| *y);
+            let Some(y) = y else {
+                self.uncertain(id, UncertaintyReason::MissingGeometry);
+                life = Life::Unresolved;
+                continue;
+            };
+            self.interval(scope, cursor, y, life);
+            cursor = y;
+            if let Some(kind) = event {
+                self.result.markers.push(Marker {
+                    occurrence: id,
+                    scope,
+                    y,
+                    kind,
+                });
+                life = match kind {
+                    MarkerKind::Birth => Life::Alive,
+                    MarkerKind::Death => Life::Absent,
+                };
+            }
+            if let Some((operator, branches)) = fragment {
+                let entry = life;
+                let mut missing = false;
+                for branch in branches {
+                    let bounds = self
+                        .span(branch)
+                        .filter(|s| s.start >= cursor && s.end <= span.end);
+                    if let Some(bounds) = bounds {
+                        // Every sibling inherits the same entry, never its displayed predecessor's exit.
+                        self.sequence(branch, entry);
+                        cursor = bounds.end;
+                    } else {
+                        self.uncertain(branch, UncertaintyReason::MissingGeometry);
+                        missing = true;
+                    }
+                }
+                if self.contains(id, None) {
+                    let reason = match operator {
+                        FragmentOperator::Alternative | FragmentOperator::Optional => {
+                            UncertaintyReason::Conditional
+                        }
+                        FragmentOperator::Loop => UncertaintyReason::Repeated,
+                        FragmentOperator::Parallel => UncertaintyReason::Parallel,
+                    };
+                    self.uncertain(id, reason);
+                    life = Life::Unresolved;
+                } else if missing {
+                    life = Life::Unresolved;
+                }
+            }
+        }
+        self.interval(scope, cursor, span.end, life);
+        self.visiting.remove(&scope);
+        life
+    }
+}
+
+#[cfg(test)]
+#[path = "scenario_lifecycle/tests.rs"]
+mod tests;

crates/oa-desktop/src/behavior/scenario_lifecycle/tests.rs

@@ -0,0 +1,470 @@
+use super::*;
+use oa_core::*;
+
+struct Fixture {
+    p: Project,
+    owner: Id,
+    a: Id,
+    b: Id,
+    exchange: Id,
+    rows: BTreeMap<Id, (Id, f32)>,
+    scopes: BTreeMap<Id, (f32, f32)>,
+}
+impl Fixture {
+    fn new(layer: Layer) -> Self {
+        let mut p = Project::empty();
+        let kind = if layer == Layer::Oa {
+            Kind::Activity
+        } else {
+            Kind::Function
+        };
+        let a = p.add_element(kind, layer, "Request", None).unwrap();
+        let b = p.add_element(kind, layer, "Provide", None).unwrap();
+        let owner = p
+            .add_element(Kind::Scenario, layer, "Lifecycle", None)
+            .unwrap();
+        let exchange = p.relate(
+            if layer == Layer::Oa {
+                RelationKind::Interaction
+            } else {
+                RelationKind::FunctionalExchange
+            },
+            "Service",
+            a,
+            b,
+        );
+        let line = |p: &mut Project, represented| {
+            let id = p
+                .add_element(Kind::Lifeline, layer, "Participant", Some(owner))
+                .unwrap();
+            *p.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+                represented: Some(represented),
+            };
+            id
+        };
+        let a = line(&mut p, a);
+        let b = line(&mut p, b);
+        Self {
+            p,
+            owner,
+            a,
+            b,
+            exchange,
+            rows: BTreeMap::new(),
+            scopes: [(owner, (0., 600.))].into(),
+        }
+    }
+    fn occurrence(&mut self, owner: Id, y: f32, body: OccurrenceBody) -> Id {
+        let mut e = self
+            .p
+            .make_element(
+                Kind::Occurrence,
+                self.p.elements[&owner].layer(),
+                "Occurrence",
+                Some(owner),
+            )
+            .unwrap();
+        let id = e.id;
+        *e.shared_mut().unwrap() = SharedBody::Occurrence {
+            body,
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        self.p.elements.insert(id, e);
+        if let Some(steps) = self.p.elements.get_mut(&owner).unwrap().steps_mut() {
+            steps.push(id);
+        } else if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Fragment { branches, .. },
+            ..
+        }) = self.p.elements.get_mut(&owner).unwrap().shared_mut()
+        {
+            branches.push(id);
+        }
+        self.rows.insert(id, (owner, y));
+        id
+    }
+    fn message(&mut self, owner: Id, y: f32, kind: MessageKind) -> Id {
+        self.occurrence(
+            owner,
+            y,
+            OccurrenceBody::Exchange {
+                exchange: Some(self.exchange),
+                sender: Some(self.a),
+                receiver: Some(self.b),
+                message_kind: kind,
+                operation: None,
+                reply_to: None,
+                values: vec![],
+            },
+        )
+    }
+    fn fragment(&mut self, owner: Id, y: f32, operator: FragmentOperator) -> Id {
+        self.occurrence(
+            owner,
+            y,
+            OccurrenceBody::Fragment {
+                operator,
+                branches: vec![],
+            },
+        )
+    }
+    fn branch(&mut self, fragment: Id, start: f32, end: f32) -> Id {
+        let id = self.occurrence(
+            fragment,
+            start,
+            OccurrenceBody::Branch {
+                guard: "condition".into(),
+                occurrences: vec![],
+            },
+        );
+        self.scopes.insert(id, (start, end));
+        id
+    }
+    fn project(&self) -> Vec<LaneLifetime> {
+        let errors: Vec<_> = validation::validate(&self.p)
+            .into_iter()
+            .filter(|i| i.severity == validation::Severity::Error)
+            .collect();
+        assert!(
+            errors.is_empty(),
+            "fixture must be ordinarily admitted: {errors:?}"
+        );
+        let before = self.p.clone();
+        let source = source_project::format_bundle(&self.p);
+        let geometry = Geometry {
+            rows: &self.rows,
+            scopes: &self.scopes,
+        };
+        let result = project_lifetimes(&self.p, self.owner, &geometry);
+        assert_eq!(result, project_lifetimes(&self.p, self.owner, &geometry));
+        assert_eq!(self.p, before);
+        assert_eq!(source_project::format_bundle(&self.p), source);
+        assert!(
+            result
+                .windows(2)
+                .all(|pair| pair[0].lifeline < pair[1].lifeline)
+        );
+        result
+    }
+    fn lane(&self) -> LaneLifetime {
+        self.project()
+            .into_iter()
+            .find(|lane| lane.lifeline == self.b)
+            .unwrap()
+    }
+}
+fn intervals(lane: &LaneLifetime, scope: Id) -> Vec<(f32, f32, Life)> {
+    lane.intervals
+        .iter()
+        .filter(|i| i.scope == scope)
+        .map(|i| (i.span.start, i.span.end, i.life))
+        .collect()
+}
+
+#[test]
+fn root_lifetime_has_exact_birth_death_boundaries_without_source_mutation() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let create = f.message(f.owner, 100., MessageKind::Create);
+        f.message(f.owner, 200., MessageKind::Asynchronous);
+        let delete = f.message(f.owner, 300., MessageKind::Delete);
+        let lane = f.lane();
+        assert_eq!(
+            intervals(&lane, f.owner),
+            vec![
+                (0., 100., Life::Absent),
+                (100., 300., Life::Alive),
+                (300., 600., Life::Absent)
+            ]
+        );
+        assert_eq!(
+            lane.markers,
+            vec![
+                Marker {
+                    occurrence: create,
+                    scope: f.owner,
+                    y: 100.,
+                    kind: MarkerKind::Birth
+                },
+                Marker {
+                    occurrence: delete,
+                    scope: f.owner,
+                    y: 300.,
+                    kind: MarkerKind::Death
+                },
+            ]
+        );
+        let sender = f
+            .project()
+            .into_iter()
+            .find(|lane| lane.lifeline == f.a)
+            .unwrap();
+        assert_eq!(intervals(&sender, f.owner), vec![(0., 600., Life::Alive)]);
+    }
+}
+
+#[test]
+fn alternative_death_does_not_kill_its_displayed_sibling() {
+    let mut f = Fixture::new(Layer::Sa);
+    let fragment = f.fragment(f.owner, 100., FragmentOperator::Alternative);
+    let left = f.branch(fragment, 120., 250.);
+    let right = f.branch(fragment, 300., 450.);
+    f.message(left, 200., MessageKind::Delete);
+    f.message(right, 350., MessageKind::Asynchronous);
+    let lane = f.lane();
+    assert_eq!(
+        intervals(&lane, left),
+        vec![(120., 200., Life::Alive), (200., 250., Life::Absent)]
+    );
+    assert_eq!(intervals(&lane, right), vec![(300., 450., Life::Alive)]);
+    assert_eq!(
+        intervals(&lane, f.owner),
+        vec![(0., 100., Life::Alive), (450., 600., Life::Unresolved)]
+    );
+    assert_eq!(
+        lane.uncertainties,
+        vec![Uncertainty {
+            scope: fragment,
+            reason: UncertaintyReason::Conditional
+        }]
+    );
+}
+
+#[test]
+fn conditional_birth_does_not_infer_absence_in_siblings_or_ancestors() {
+    for operator in [FragmentOperator::Alternative, FragmentOperator::Optional] {
+        let mut f = Fixture::new(Layer::Oa);
+        let fragment = f.fragment(f.owner, 100., operator);
+        let left = f.branch(fragment, 120., 250.);
+        let right = f.branch(fragment, 300., 450.);
+        f.message(left, 200., MessageKind::Create);
+        let lane = f.lane();
+        assert_eq!(
+            intervals(&lane, left),
+            vec![(120., 200., Life::Absent), (200., 250., Life::Alive)]
+        );
+        assert_eq!(
+            intervals(&lane, right),
+            vec![(300., 450., Life::Unresolved)]
+        );
+        assert_eq!(
+            intervals(&lane, f.owner),
+            vec![(0., 100., Life::Unresolved), (450., 600., Life::Unresolved)]
+        );
+    }
+}
+
+#[test]
+fn loop_lifetime_is_local_and_warning_bearing_loops_remain_drawable() {
+    for balanced in [true, false] {
+        let mut f = Fixture::new(Layer::Sa);
+        let fragment = f.fragment(f.owner, 100., FragmentOperator::Loop);
+        let iteration = f.branch(fragment, 120., 450.);
+        let create = f.message(iteration, 160., MessageKind::Create);
+        f.message(iteration, 250., MessageKind::Asynchronous);
+        if balanced {
+            f.message(iteration, 350., MessageKind::Delete);
+        }
+        let lane = f.lane();
+        assert_eq!(lane.markers.len(), if balanced { 2 } else { 1 });
+        assert_eq!(lane.markers[0].occurrence, create);
+        assert!(lane.uncertainties.contains(&Uncertainty {
+            scope: fragment,
+            reason: UncertaintyReason::Repeated
+        }));
+        assert_eq!(
+            intervals(&lane, f.owner).last().unwrap().2,
+            Life::Unresolved
+        );
+        assert_eq!(
+            validation::validate(&f.p)
+                .iter()
+                .any(|i| i.code == "lifeline_repetition"),
+            !balanced
+        );
+    }
+}
+
+#[test]
+fn optional_cleanup_inside_loop_does_not_claim_balanced_or_definite_exit() {
+    let mut f = Fixture::new(Layer::Sa);
+    let repeated = f.fragment(f.owner, 100., FragmentOperator::Loop);
+    let iteration = f.branch(repeated, 120., 500.);
+    f.message(iteration, 160., MessageKind::Create);
+    let optional = f.fragment(iteration, 280., FragmentOperator::Optional);
+    let cleanup = f.branch(optional, 320., 400.);
+    f.message(cleanup, 350., MessageKind::Delete);
+    let lane = f.lane();
+    assert_eq!(
+        intervals(&lane, cleanup),
+        vec![(320., 350., Life::Alive), (350., 400., Life::Absent)]
+    );
+    assert_eq!(
+        intervals(&lane, iteration),
+        vec![
+            (120., 160., Life::Absent),
+            (160., 280., Life::Alive),
+            (400., 500., Life::Unresolved)
+        ]
+    );
+    assert!(
+        validation::validate(&f.p)
+            .iter()
+            .any(|i| i.code == "lifeline_repetition")
+    );
+    assert!(lane.uncertainties.contains(&Uncertainty {
+        scope: optional,
+        reason: UncertaintyReason::Conditional
+    }));
+    assert!(lane.uncertainties.contains(&Uncertainty {
+        scope: repeated,
+        reason: UncertaintyReason::Repeated
+    }));
+}
+
+#[test]
+fn lifecycle_free_fragments_do_not_poison_other_lanes() {
+    let mut f = Fixture::new(Layer::Oa);
+    let fragment = f.fragment(f.owner, 100., FragmentOperator::Parallel);
+    let left = f.branch(fragment, 120., 250.);
+    let right = f.branch(fragment, 300., 450.);
+    f.message(left, 200., MessageKind::Delete);
+    let result = f.project();
+    let sender = result.iter().find(|lane| lane.lifeline == f.a).unwrap();
+    assert!(sender.intervals.iter().all(|i| i.life == Life::Alive));
+    assert!(sender.uncertainties.is_empty());
+    let target = result.iter().find(|lane| lane.lifeline == f.b).unwrap();
+    assert!(target.uncertainties.contains(&Uncertainty {
+        scope: fragment,
+        reason: UncertaintyReason::Parallel
+    }));
+    assert_eq!(intervals(target, right), vec![(300., 450., Life::Alive)]);
+}
+
+#[test]
+fn explicit_receiver_is_authoritative_even_with_missing_exchange() {
+    let mut f = Fixture::new(Layer::Oa);
+    let create = f.message(f.owner, 100., MessageKind::Create);
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange { exchange, .. },
+        ..
+    }) = f.p.elements.get_mut(&create).unwrap().shared_mut()
+    {
+        *exchange = None;
+    }
+    assert_eq!(f.lane().markers[0].occurrence, create);
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            receiver, exchange, ..
+        },
+        ..
+    }) = f.p.elements.get_mut(&create).unwrap().shared_mut()
+    {
+        *receiver = None;
+        *exchange = Some(f.exchange);
+    }
+    assert!(
+        f.lane().markers.is_empty(),
+        "exchange endpoints never invent a receiver"
+    );
+}
+
+#[test]
+fn missing_geometry_is_reported_without_nonfinite_or_guessed_markers() {
+    let mut f = Fixture::new(Layer::Oa);
+    let create = f.message(f.owner, 100., MessageKind::Create);
+    f.rows.insert(create, (f.owner, f32::NAN));
+    let lane = f.lane();
+    assert!(lane.markers.is_empty());
+    assert_eq!(
+        lane.uncertainties,
+        vec![Uncertainty {
+            scope: create,
+            reason: UncertaintyReason::MissingGeometry
+        }]
+    );
+    assert_eq!(
+        intervals(&lane, f.owner),
+        vec![(0., 600., Life::Unresolved)]
+    );
+    f.scopes.remove(&f.owner);
+    let lane = f.lane();
+    assert!(lane.intervals.is_empty());
+    assert_eq!(lane.uncertainties[0].scope, f.owner);
+}
+
+#[test]
+fn scenario_use_is_opaque_and_never_imports_callee_lifecycle_events() {
+    let mut f = Fixture::new(Layer::Oa);
+    let callee =
+        f.p.add_element(Kind::Scenario, Layer::Oa, "Callee", None)
+            .unwrap();
+    let remote_a =
+        f.p.add_element(Kind::Lifeline, Layer::Oa, "Remote A", Some(callee))
+            .unwrap();
+    let remote_b =
+        f.p.add_element(Kind::Lifeline, Layer::Oa, "Remote B", Some(callee))
+            .unwrap();
+    for (remote, local) in [(remote_a, f.a), (remote_b, f.b)] {
+        let body = f.p.elements[&local].shared().unwrap().clone();
+        *f.p.elements.get_mut(&remote).unwrap().shared_mut().unwrap() = body;
+    }
+    f.occurrence(
+        callee,
+        200.,
+        OccurrenceBody::Exchange {
+            exchange: Some(f.exchange),
+            sender: Some(remote_a),
+            receiver: Some(remote_b),
+            message_kind: MessageKind::Create,
+            operation: None,
+            reply_to: None,
+            values: vec![],
+        },
+    );
+    f.occurrence(
+        f.owner,
+        100.,
+        OccurrenceBody::ScenarioUse {
+            scenario: Some(callee),
+            bindings: vec![
+                LifelineBinding {
+                    referenced: remote_a,
+                    local: f.a,
+                },
+                LifelineBinding {
+                    referenced: remote_b,
+                    local: f.b,
+                },
+            ],
+        },
+    );
+    let lane = f.lane();
+    assert_eq!(intervals(&lane, f.owner), vec![(0., 600., Life::Alive)]);
+    assert!(lane.markers.is_empty());
+    assert!(lane.uncertainties.is_empty());
+}
+
+#[test]
+fn projection_retains_exact_authored_source_and_does_not_enter_history() {
+    use crate::document::Document;
+    let mut f = Fixture::new(Layer::Oa);
+    f.message(f.owner, 100., MessageKind::Create);
+    f.message(f.owner, 300., MessageKind::Delete);
+    let mut source = source_project::format_bundle(&f.p);
+    let text = source.files.get_mut(&source.entry).unwrap();
+    *text = format!("// Retained author note — 雨\r\n{text}\n");
+    let document =
+        Document::from_bundle(source.clone(), source_project::ProjectLimits::default()).unwrap();
+    let accepted = document.project().clone();
+    let geometry = Geometry {
+        rows: &f.rows,
+        scopes: &f.scopes,
+    };
+    let result = project_lifetimes(document.project(), f.owner, &geometry);
+    assert_eq!(result, f.project());
+    assert_eq!(document.bundle(), &source);
+    assert_eq!(document.project(), &accepted);
+    assert!(!document.can_undo());
+    assert!(!document.can_redo());
+}