# Ordinary source8 compatibility — independent source review

No production blocker found in the bounded draft. Reviewed against root contract committed locally at `fb9b0c5c`, `harness/ordinary-source8-compatibility-contract-20260925.md`, SHA256 `e3b24beb14ce7c1c506666aceb18233df90a09fc849cf59eb862f6eb48e08f76`. Source base is `edf096cd33350865ecfc3c65ec266a6c0d3c4000` on `codex/ordinary-source8-956atf-20260925`; working `crates/oa-core/src/language.rs` SHA256 is `d0ba16e05c80ede859506de84dab0d54ba8ca97996b2db020e5f0e0d7771dcf1`. This is read-only source review; no compiler or application was executed and no implementation was edited. Final commit, test review and runtime gates remain pending.

The sole production behavior change at `language.rs:1548..1556` adds the exact token8 to the ordinary accepted-version list and updates the unsupported-version diagnostic. Existing exact matches still reject malformed/future versions. The private mixed branch still requires exactly8. The other edits clarify public ordinary versus private mixed scope and register a cfg(test) child module.

Current-version ordinary resolution already takes the unchanged `resolve_declarations` path at `language.rs:2130..2149`: caller model checks precede `DecodeResult { migration: None }`. Versions3–7 retain their earlier explicit migration paths, including source migration and recompilation at current8. The new gate therefore repairs the writer/current-reader mismatch without installing a second resolver or changing conversion semantics. Whether every formerly masked assertion succeeds requires actual execution.

Caller ParseLimits/ProjectLimits, strict tokens, location mapping, generated/explicit UUID handling, nested lexical ownership, SourceIndex construction and compilation re-indexing are unchanged. `compile_bundle` still stabilizes missing IDs, reparses returned bytes and migrates older source. The patch does not alter the updater's stale bundle/model/index checks or its final complete-model equality check; checked save continues to recompile before filesystem staging. No private AcceptedRename is substituted for CompiledSourceProject and no incomplete index is fabricated.

Both analysis refusal mechanisms remain present. Short source8 analysis words have no ordinary declaration kind and refuse in the ordinary parser; long ordinary analysis constructors may parse syntax but `construct_declarations` still rejects `kind.is_analysis()` at `language.rs:1861`. Reaching that latter branch should be tested with an otherwise syntactically valid declaration so another error cannot mask it. Existing public formatter omissions and unsupported typed output remain limitations, not made safe or complete by this gate change.

No cfg(test) mixed hook is promoted; Parser state layout, budget/producers and lifetimes are untouched. Generic values retain depth64, typed expressions retain logical128, and no codec qualification, DEPTH_128_VALIDATED flag, limits or stack size is changed. Runtime obligations include all292 prior core names, the16 previously schema-blocked tests' actual assertions, source/JSON checked saves, relevant integration suites, and a non-test CLI check/rename preview. Passing only the new gate test would not establish those outcomes.

## Committed binding — 33b86a4d

Confirmed clean tracked HEAD `33b86a4d6b4bc1b156a93ae3596fe0ad7b4dbbe5`, committed locally. The exact baseline→candidate diff contains four files: `language.rs`, new `language_ordinary_source8_tests.rs`, existing integration test `tests/source7_contract.rs`, and `harness/ordinary-source8-compatibility-implementation-20260925.md`. No existing core-library test body changed. Production remains the exact `d0ba16e0` hash above; contract provenance remains local `fb9b0c5c`, not a remote publication.

New test file SHA256 `59e1afe4f61f7e1c80a283c6ad8bbbe26d46ca16c624c1125f3d2b5d4115de95` has six tests. Source review confirms substantive model/bundle/index comparisons, versions3–7 idempotence, included/nested omitted IDs and CRLF, current limits/stale-input refusal, real source/JSON checked-save calls and a genuinely formatter-lost definition refusal. The CLI literal test authors complete independent before/after models and exact bytes; it does not itself execute the CLI. Root's actual CLI run remains required.

The authorized source7 evaluator correction, SHA256 `f6385ee7716b3431e4b0fc4073531ef0337917b3a1ae62a715b5dc9250e65880`, is confined to `source7_source_bundle_migration_is_token_only_and_new_link_stays_with_caller`: assert writer-produced8, replace that actual token with the existing commented6 fixture, verify replacement occurred, and expect migration to8. The old replacement searched nonexistent7 and could not manufacture the intended old-version input. All later byte/module/model/update assertions and the test name remain unchanged. This repairs the evaluator without redefining migration behavior.

One concrete new-test coverage finding was sent to parent/implementer: the short refusal table uses `oa_case`/`sa_case`, whereas the actual private short case words are `oa_analysis`/`sa_analysis`. Rejection of those invalid spellings does not independently cover the two actual short case forms. Add the actual spellings before claiming all nine short forms are individually covered; long ordinary analysis constructors already assert the specific conversion-refusal message. This is a test-coverage correction, not an observed production failure. Compiler/runtime acceptance remains parent-owned and pending at this binding.

## Initial focused failure and reviewed repair

Initial33b86a4d compiled and its focused run finished5 passed/1 failed. The failure is the new example fixture's `!example.traces.is_empty()` assertion, not a production parser/save refusal. The six-file example has no trace declarations. The original focused raw log and receipt remain in `.local/ordinary-source8-gates-20260925/ordinary-focused-33b86a4-1.*`; no later correction replaces this outcome.

Reviewed repaired new-test file SHA256 `e85ce6c793f59be6991f76d297363e709bc3ab4dd30b99b66ee1a40354b8d80e`. It explicitly adds a Participant trace to the compiled example before the unchanged whole-model format/parse and bundle round trips. Its fixed endpoints are actual OA Entity rescue_team (`00000000-0000-4000-8000-000000000102`) and SA System rescue_system (`00000000-0000-4000-8000-000000000301`); these match the source fixtures and `validation::trace_permits` at2718. The test asserts endpoint kinds, insertion into an empty ID slot and the complete authored trace. This establishes actual trace coverage instead of weakening the missing-fixture assertion. Both actual short words `oa_analysis`/`sa_analysis` are added; the coverage finding above is resolved. Production remains unchanged at `d0ba16e0`.

Independently inspected the unchanged historical fixture `tests/fixtures/v4-reviewed-prose.json`, SHA256 `2808088afcc165f4bd6da5129151143411c997041c3de61d600ab76e05d24a47`. It contains exactly one Item trace, ID `40000000-0000-4000-8000-000000000004`, linking OA/SA datatype IDs ending002/003. Its historical baseline stores OA name `Approved OA name`, OA description `Approved OA\nprose`, SA name `Approved SA name` and SA description `Approved SA prose`, deliberately distinct from current prose. There is no semantic-facet snapshot. Existing `tests/r3_migration.rs:9..38` independently asserts migration from4, those historical fields, semantic=None and equality with the original JSON except its schema version. The new whole-model roundtrip over this migrated fixture therefore exercises retained prose history; it must not be described as semantic-facet coverage. No additional decoder/runtime execution was performed for this readback. Corrected runtime results and repair commit binding remain pending.

Final repair binding: independently confirmed clean tracked HEAD `520e50ce62f067dff69f03760c8b12929df9b920`. Its exact33b86→520e diff contains only the reviewed new test file and implementation note; language production and the authorized source7 evaluator are unchanged. The test retains the `e85ce6c7` hash above. This is a local commit, not a publication claim. No source-review finding remains open; parent-owned corrected runtime/integration/CLI acceptance remains pending at this binding.

## Four inherited expectation conflicts exposed by the full run

The initial full520 run finished298 tests:294 passed/four failed. All16 previously schema-blocked ordinary tests passed. Four private analysis tests still asserted that an empty or ordinary schema8 document must be rejected. Those expectations contradicted the selected ordinary compatibility contract; the initial review did not identify them before execution. This was a missed evaluator dependency, not evidence that accepting ordinary8 is a production defect. Preserve the full raw log `ordinary-full-520e50c-1.log`, SHA256 `84b9e7a3a43e9f829a594a660e32faf574008718d7df46b87ac1d9661865fdd3`, and its original names/results.

Reviewed the narrow follow-up patch: ordinary8 must succeed without migration, complete ordinary fixed-ID OA/SA projects must equal their migrated predecessor models, and actual typed bodies/canonical typed output still refuse through public parsing. The declarations negative loop now includes versions3..=8. All existing numeric token checks, contextual-name/root constraints, complete independent17-UUID lowering comparisons, reference/expression invariants, semantic admission and canonical typed roundtrips remain. Production `language.rs` remains exact `d0ba16e0`.

Reviewed repaired test hashes relative to `crates/oa-core/src/language/analysis_source/`:

| File | SHA256 |
| --- | --- |
| `declarations/tests.rs` | `41051822b4954441a2ff94c923ae734f391269d9335d312b113e9bf4ddceeb00` |
| `lower/tests.rs` | `257f3e82380a33ba783d9aedb738283ff5d6f2bd4e943680030b42536bb56f15` |
| `tests.rs` | `d1a98ccd213e31496c1163c7ed3ee82bd910547bfe22b5fd72862555ec859fd3` |
| `write/tests.rs` | `b366b684776cd83ab39cf4391a14ec378465f15b6a54e4ece396c84bf1f17084` |

Only the two parent-authorized evaluator names change:

- `inherited_version_root_and_short_word_contracts_do_not_enable_public8` → `inherited_version_root_and_short_word_contracts_do_not_enable_public_typed8`.
- `public_source_headers_and_existing_numeric_token_controls_are_unchanged` → `public_ordinary_source8_preserves_typed_refusal_and_numeric_controls`.

The lower/write test names remain unchanged. Final inventories must use this exact two-name correspondence, not drop unmatched cases or normalize arbitrary names. No source-review blocker was found in this patch. The initial33b86a4d five-pass/one-failure and520e50ce294-pass/four-failure outcomes remain historical failures, not rewritten passes.

Final expectation-repair binding: independently confirmed clean tracked HEAD `0c07f53ab517626f536f79dbaa2885a587bf1db7`. Exact520→0c07 scope is the four test files above plus the implementation note; all four test hashes and unchanged production hash were reread. The amended root contract is committed locally at `69c784f2`, SHA256 `4f6b308842fb240fdbcc22a4787ba1123f2432c92ddf08b978ae61b4e38204bb`, explicitly authorizing the expectation alignment and exact name mapping. No publication or repaired-runtime claim follows from this source binding.

## Historical JSON oracle correction

The initial0c07 `r3_migration` integration run finished four passes/one failure, preserved in `ordinary-integration-suite-r3_migration-0c07f53-1.log`. The failed whole-JSON comparison differs by the current top-level `definitions: {}` field. `model.rs:1652..1661` derives Serialize for this unconditional field; `migration_v4.rs:66..78` explicitly constructs an empty definitions map when converting the old model. This is the current schema's empty catalog, not a fabricated historical review or analysis definition. The earlier paragraph's description of the r3 oracle as changing only the schema version described its then-stale expectation; this checkpoint explicitly supersedes that expectation.

Independently confirmed clean tracked HEAD `7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd`. Exact0c07→7b scope is only `crates/oa-core/tests/r3_migration.rs` and the implementation note. The test adds three lines: assert the frozen fixture lacks definitions, assert the migrated project catalog is empty, and add the literal empty object to expected current JSON. It retains full JSON equality for both JSON/source decoding, all migration and historical trace assertions, semantic=None, and whole-model reopen equality. Neither production nor the fixture changes. No source-review blocker was found; repaired runtime remains parent-owned.

Final test SHA256 `a8ad8d6edaae8f0583595098eb27022331fe0e69ee27cfa78835bfa1753feb96`; implementation note SHA256 `7d2b34649625cbefca46aa9ea837de6bc9784c1299aa293240782261a1dbddcf`. These are local commit bindings, not publication or new execution claims.