# Source8 S0/S1 source handoff

2026-09-13, Codex-956atf /root/nested_call_design. Source-only work in `.local/analysis-core-worktree-20260911`, branch `codex/analysis-core-20260911`. The worktree is clean at **02b9d5ce4c73d0446146b13b46a228e6fd4d7735**. No compiler, Cargo, test executable, native UI or Gitea write was run by this worker. Root owns publication, integration and compiler leases. Latest fetched bff8014 AGENTS instructions were read; its documentation commits were not merged and the user-owned specification was untouched.

## Pins and design

- Original input: `847b1caa7e75bb82f6ce5193c45bcfc45973ad1a`.
- S0 containment: `112e0d910bd2b2c9a191f29536fecb0fbc0177b0`, two files, 187 insertions/4 deletions.
- S1 staged syntax: `02b9d5ce4c73d0446146b13b46a228e6fd4d7735`, six files, 1345 insertions, directly atop S0.
- Revised design: `analysis-source8-repair-design-r2-20260913.md`, SHA256 `3a5b96fd130e3859932ee25544b3ff2f6a21f0774f3b5849e546f9574b9dbf7d`. Original db2e266 design preserved. Root accepted the corrected syntax/oracle direction, candidate resource table for experiments and reversible default module names; measurements/profile adoption remain open.

## S0

The generated `.arcadia` bytes receive their final newline, then pass the public limited decoder with the same effective profile byte limit. Whole Project inequality and unexpected migration reject before NamedTempFile creation. The source-format function is injectable only through a private seam. Existing JSON encode, expected-original conflict and persistence code retain their behavior; no source8 header whitelist or JSON/depth change was added.

Four tests under `persistence::source_save_tests::`, all unrun:

- `malformed_generated_source_rejects_before_any_filesystem_staging`
- `parseable_source_omitting_a_definition_cannot_replace_the_whole_project`
- `equal_project_from_generated_legacy_source_still_rejects_migration`
- `generated_source_admission_checks_final_newline_under_the_effective_byte_limit`

Each checks existing/new/missing-parent destinations. Missing parent distinguishes decode-before-temp from a later temp creation that would fail with Io. The independently parsed legacy source equals the ordinary Project for the migration control; the lossy control adds an actual unused Duration definition while preserving ordinary headers/records. The original public checked-save regression is unchanged and is expected to remain failing at save until full source8 support exists. Containment is not persistence completion.

## S1

`language.rs` adds only a four-line **cfg(test)** module declaration. The old shared tokenizer, source3–7 parser and public source8 rejection are byte-identical in their implementations. The typed raw lexer is private and test-staged until the S2 consumer can integrate signed ordinary numeric consumption compatibly. This avoids exposing an unfinished global lexer/reader combination.

New `language/analysis_source` modules supply unresolved typed Binding/Expr syntax and exact source spans. They cover all13 existing Expr shapes, named arguments, scoped-name syntax, required constructor arity, literal-only quantities, explicit Sum initial, bounded Power, precedence and non-chaining comparisons. They do not resolve aliases/ParameterIds, validate purity/types or produce a Project. The parser uses an explicit task/value stack, with syntactic frame and logical AST depth checks. Accepted partial ASTs have depth at most128; ordinary owned-tree teardown remains bounded by that depth.

Raw numeric lexing never invokes serde_json::Number. Significant ratio tokens are checked and reconstructed into a bounded numeric-only spelling, passed to the existing metered Exact parser; full raw literal span and individual punctuation/component spans survive. Call argument occurrences retain unique spans even when their callee/parameter names repeat. Actual qualified SourceIndex entries and token-preserving command updates belong to S3; the span replacement test is a syntax discriminator, not a claim that production rename works.

An explicitly shared Budget aggregates bytes, lexical tokens (including skipped trivia), syntax entries, references and exact numeric units across fragment parse calls, with bounded active frames. Reservations precede token/AST/reference allocation, duplicate attempted call entries are charged, and resource exhaustion is latched. Candidate ceilings derive from the r2 table and existing lowerable ParseLimits; no measured resource adoption is claimed. Full declaration/graph/include/reference accounting and entry-version selection remain S2/integration work; expression-only budget tests cannot prove whole-bundle admission or optimized RSS.

Nine tests under `language::analysis_source::tests::`, all unrun:

- `significant_ratio_and_quantity_trivia_preserve_original_spans`
- `raw_numeric_lexing_preserves_exact_atoms_and_operator_boundaries`
- `unary_literals_precedence_and_comparison_children_keep_distinct_trees`
- `every_expression_shape_and_exact_constructor_arity_is_represented`
- `repeated_call_argument_occurrences_have_distinct_original_spans`
- `budgets_aggregate_across_fragments_and_latch_numeric_exhaustion`
- `byte_token_frame_logical_and_list_boundaries_have_nearby_successes`
- `partial_wide_and_deep_input_cleanup_does_not_poison_a_fresh_parse`
- `public_source_headers_and_existing_numeric_token_controls_are_unchanged`

They cover exact negative Number versus Unary, comparison left/right grouped children, 400-digit atoms, comments inside ratios and before units, repeated call keys, malformed arity/components, per-budget near successes/failures, numeric exhaustion across fragments and cleanup. They do not establish canonical source writing, source-edit preservation, S2/S3 functionality or CPU/memory timing.

## Performed and remaining checks

Rustfmt edition2024/skip_children was run on the two S0 Rust paths and six S1 Rust paths using the configured local toolchain; all invocations exited0. Git whitespace checks passed. No execution result is claimed.

Next: independent immutable-source review of S1 and root-assigned compiler gate selecting both test prefixes, retaining the unchanged public regression as the known incomplete-source8 witness. Fix findings in a new commit without changing old evidence. Then proceed to S2/S3 under explicit ownership, and root's final migration/version/resource acceptance. No merge of remote documentation history or force-push was attempted here.