# Ordinary source8 compatibility: independent verification plan

Read-only source review against private baseline `edf096cd33350865ecfc3c65ec266a6c0d3c4000` and selected root contract `harness/ordinary-source8-compatibility-contract-20260925.md` (parent identifies root `fb9b0c5c`). Implementation is currently uncommitted; this is a plan, not execution evidence. No compiler, application, CLI, or archived evaluator was run for this review.

## Smallest useful gate set

Parent owns serial execution, source/artifact pins and available disk space. Reuse the existing target directory, jobs=1 and incremental=0 environment. Do not build the workspace. First list each selected target/filter and retain the actual nonzero name inventory; subsequent execution must cover those exact names. Commands below run from `.local/as3batch`; append `-- --list` instead of the execution harness arguments for inventory.

1. Run the new focused ordinary-source8 tests, the full core library, strict core all-target Clippy and the existing format gate. Preserve all 292 prior core names and compare actual outcomes, rather than merely subtracting the old 16 failures. The six `language::nesting_tests` and ten `source_files::transaction_tests` formerly stopped at schema admission; their newly reached assertions matter. Transactions are a **library module**, not a separate integration target. Keep all private acceptance and existing stack controls in the full library suite. Existing `persistence::source_save_tests` must continue refusing malformed, lossy and migrating generated output before staging.
2. Run these existing complete integration targets, each with `cargo test --locked --offline -p oa-core --test TARGET -- --test-threads=1`: `source_project`, `source_identity_updates`, `source_nested_updates`, `source_files`, and `r3_migration`.
3. Run `cargo test --locked --offline -p oa-core --test review_regressions checked_save_ -- --test-threads=1`. Inventory must contain exactly the three checked-save functions below. The rest of that large integration target is not required just to establish this compatibility repair.
4. Run the named source7 migration/update test below after repairing its stale fixture assumption, using `--test source7_contract source7_source_bundle_migration_is_token_only_and_new_link_stays_with_caller -- --exact --test-threads=1` after the common Cargo prefix.
5. Build only the actual non-test consumer with `cargo build --locked --offline -p oa-cli --bin arcadia`, then perform the read-only commands below. `crates/oa-cli/Cargo.toml` defines binary `arcadia`; do not guess an `oa-cli.exe` filename. Record the resulting executable's actual path/hash and source/environment binding.

These targets are Cargo's ordinary `tests/*.rs` integration targets; core Cargo.toml does not require a special feature. Selecting complete related targets avoids silently omitting newly reached assertions while limiting separate test binaries. The CLI integration target `source_cli` is useful existing coverage but is not a prerequisite for this minimal set: its tests also perform saves. It is not a substitute for the requested actual read-only schema8 consumer invocation.

## What the integration targets establish

| Target | Source-backed discriminating names and purpose |
| --- | --- |
| `source_project` | `cross_file_typed_ports_global_forward_references_and_stable_ids`; `advisory_lint_locations_refer_to_raw_drafts_before_identity_stabilization`; `source_errors_keep_exact_fragment_unicode_positions`; `generated_id_insertion_handles_adjacent_header_tokens_and_remains_exactly_indexed`; `model_updates_rewrite_cross_file_alias_uses_preserve_ownership_and_untouched_comments`; `failed_update_preserves_candidate_and_rejects_stale_index`; `scalar_header_guard_and_project_edits_preserve_exact_crlf_trivia_and_escape_spelling`; `alias_updates_touch_only_header_and_reference_tokens_even_with_comments_after_at`. Also covers includes, aggregate admission, canonical export and whole-model updates. |
| `source_identity_updates` | All three: `identity_and_alias_edit_keep_authored_file_and_reference_rationale`, `identity_swap_and_reorder_keep_both_declarations_and_item_comments_with_origin`, `provenance_cannot_merge_records_or_cross_record_classes`. |
| `source_nested_updates` | Includes `nested_scalar_edits_touch_only_authored_tokens`, `cross_file_move_carries_attached_comments_and_subtree_but_leaves_gap_notes`, `nested_uuid_alias_swap_and_cross_file_move_follow_command_provenance`, `nested_typed_reference_list_updates_keep_item_rationale_while_port_moves`, `crlf_moved_and_new_children_preserve_authored_and_destination_line_endings`, and `deep_structural_writeback_runs_on_a_small_thread_stack`; other cases cover reparenting, deletion, lexical ownership and nonoverlapping edits. |
| `source_files` | `loading_keeps_original_no_uuid_bytes_and_saving_stabilizes_exactly_once`; `discovery_never_refreshes_drafts_and_preserves_detached_buffers`; `unchanged_dependency_edits_and_deletions_block_save_before_any_write`; `new_destinations_require_explicit_missing_expectations_and_reject_collisions`; `forged_compiled_model_or_index_cannot_be_saved`; actual aggregate/path/hard-link safeguards. Unix-only symlink, named-pipe and permission tests are excluded by cfg on Windows: do not claim they ran. |
| `r3_migration` | In particular `authored_v4_modules_upgrade_only_the_version_and_preserve_nested_comments`, which recompiles migrated bytes idempotently and preserves the caller's draft; `frozen_v4_json_and_source_preserve_the_old_review_without_fabricating_semantics`; `older_headers_cannot_admit_new_semantic_baselines`; `original_v1_v2_v3_inputs_complete_the_explicit_upgrade_to_five`. Current source3–7 coverage must additionally come from the new focused regression; a historical function name is not a current output-schema assertion. |

The three `review_regressions.rs:454..` functions are `checked_save_returns_exact_bytes_and_accepts_unchanged_external_content`, `checked_save_rejects_external_changes_and_preserves_their_exact_bytes`, and `checked_save_rejects_external_deletion_without_recreating_the_file`. **Each loops over `project.arcadia` then `project.oa.json` in that order.** A successful function must now reach its second JSON branch. They check exact returned/disk bytes, whole decoded model, unchanged repeat, external edit preservation and deletion refusal. Previously failing first-source behavior could mask JSON behavior; do not count an early source failure as JSON evidence.

Concrete static issue: `source7_contract.rs:1035` creates current formatter output, then attempts to replace literal `arcadia 7;` with a commented schema6 header. It also expects migration to literal ` 7;`. Current formatter output is schema8, so the initial replacement does not downgrade it and the later migration unwrap is unsupported. Repair the fixture explicitly to construct old6 from the actual current header and expect current-schema output, retaining exact comments/module bytes, whole-model equality, relation ownership and recompile checks. This is an evaluator correction, not permission to remove the test or weaken migration behavior. Report any further newly reached stale expectations individually.

## Actual read-only CLI oracle

Create a fresh isolated fixture directory outside source, with exactly three UTF-8 files without BOM. Each shown `\r\n` denotes actual CRLF; use byte writes so shell newline handling cannot change the oracle. UUID literals below are complete.

```text
project.arcadia:
// 雨\r\narcadia 8;\r\nproject p "Project" id "00000000-0000-0000-0000-000000000001" {\r\ninclude "participants.arcadia"; include "children.arcadia";\r\n}\r\n

participants.arcadia:
// @team remains documentation\r\noa_entity team "Team @team" id "00000000-0000-0000-0000-000000000002" {}\r\n

children.arcadia:
oa_entity child "Child" id "00000000-0000-0000-0000-000000000003" { parent @team; }\r\n
```

Run the built executable (absolute path) twice, capturing exact argv, exit status, stdout and stderr:

```text
arcadia.exe check <absolute-fixture-entry-path> --json
arcadia.exe rename-alias <absolute-fixture-entry-path> team rescue_team --json
```

These are actual `arguments()` forms in `crates/oa-cli/src/lib.rs`, dispatched by `main.rs`. Neither includes `--write`. Explicit IDs remove random UUID allocation from the expected report.

Expected common report fields: `format_version=1`, supplied `entry` path, `exit_code=0`, `written=false`, `identities_to_stabilize=0`, `migration=null`, and no diagnostics for these named ordinary entities. Check reports `operation="check"`, `status="checked"`, `changes=[]`. Rename reports `operation="rename-alias"`, `status="preview"` and exactly two changes ordered by path: `children.arcadia`, `participants.arcadia`. Each `before` must equal its complete original literal. The complete expected `after` is the same literal with only `parent @team;` changed to `parent @rescue_team;` in children and only the declaration `oa_entity team ` changed to `oa_entity rescue_team ` in participants. The comment and display-name `@team` remain byte-identical. No entry-file change is permitted. Check the human diff reflects those same edits; complete `after` bytes, not diff presence, are the decisive oracle. Notes are explanatory implementation text and do not authorize a write.

Before either invocation record sorted directory inventory and every file's full bytes/length/SHA256. Compare all three actual files and the complete directory inventory immediately after **each** invocation; report output is not proof of unchanged input. In particular `project.arcadia` remains identical both on disk and absent from reported changes. Keep captures outside the fixture directory so they cannot confuse this check.

The CLI JSON schema does **not** expose the whole resolved Project. Do not invent such an assertion from report fields. Semantic expectation is unchanged project UUID/name, unchanged entity UUIDs/names/parent identity, with only ID2's alias becoming `rescue_team`. The existing whole-model integration assertions provide the supporting model evidence (`source_project` updates and identity tests). If a candidate-specific CLI-result whole-Project equality is required, add a small parent-owned test through existing public compile APIs that assembles the literal reported candidate and compares a fully authored Project; keep it distinct from the non-test CLI invocation and do not add a production export command. Existing `oa-cli/tests/source_cli.rs::alias_rename_across_modules_changes_only_live_tokens_and_retains_all_identity` demonstrates that model check, but also writes and uses a legacy schema7 setup; it is not the read-only current8 fixture itself.

## Admission and limits

Retain initial failures and exact source/test changes separately from repaired outcomes. List and execute on the same frozen candidate; retain receipt inputs, Git/disk equality, launchers/environment, executable hashes and raw outcomes. Investigate newly exposed JSON-save or transaction errors at their own layer. Full ordinary source8 compatibility does not imply support for analysis constructors, typed source syntax, complete typed formatting, depth128 qualification, or publication. Preserve `DEPTH_128_VALIDATED=false`, existing parser/storage/depth policies and the full-pipeline small-stack limitation. Linux remains user-deferred; cfg-excluded tests are not Windows passes. This plan adds no workspace-wide build and makes no acceptance claim.