ARCADIA-Studio/harness/release-analysis-next-acceptance-20260913.md

# Analysis candidate: next bounded acceptance experiment

Source-only independent review, 2026-09-13, Codex-956atf `/root/nested_call_design`; parent owns Gitea #7 and integration. No compiler, rustc, native UI, Gitea, candidate import, or production-switch changes were performed. Linux remains deferred. All commands below are proposals for the parent's next authorized compiler lease, not executed validation.

## Recommendation

Run the existing **public checked-save round-trip regression first**, against isolated candidate `847b1caa7e75bb82f6ce5193c45bcfc45973ad1a`. It is a smaller and more foundational experiment than adding memory instrumentation or more private depth fixtures. It directly checks whether ordinary user work can survive a successful source save. No new test is needed to expose the immediate boundary.

Working directory: `.local/analysis-core-worktree-20260911` (branch `codex/analysis-core-20260911`; exact HEAD and clean status rechecked).

```text
cargo test --locked -p oa-core --test review_regressions checked_save_returns_exact_bytes_and_accepts_unchanged_external_content -- --exact --test-threads=1 --nocapture
```

Input is the test's real `Project::empty()`, then a changed description containing Unicode 海岸 and a newline, saved using both `.arcadia` and `.oa.json`. Success requires exactly one selected test, successful save, disk bytes equal returned bytes, public decode equal to the complete Project, and repeat checked-save bytes unchanged. Preserve command, toolchain/linker/runtime identities, source/binary hashes, complete output and exit status. An unrelated build failure is a blocked execution, not a passed evaluator.

**Predicted result, not an executed failure:** the `.arcadia` iteration reaches its public decode assertion and rejects its own version-8 header. The candidate's `language.rs:577` formatter writes `SCHEMA_VERSION` (8), while `language.rs:1408` accepts only source versions 3–7. `persistence.rs:932`'s checked-save implementation formats `.arcadia` directly and replaces the destination without the encode/decode equality check used by its JSON branch. `review_regressions.rs:454` already tests precisely this closure. The existing private `production_save_always_reopens_with_its_reader_profile` test uses `project.json`; its success does not cover this source branch.

This is evidence of the documented unfinished source8 integration, not a new claim that the private JSON codec is broken. Merely accepting a version-8 header is insufficient: `language.rs:593`'s declaration formatter does not emit the definition catalog, and `language.rs:1653` explicitly rejects analysis records pending source8 authoring. Preserve the current test and failed artifact before repair. Do not weaken equality, silently omit new records, or enable `DEPTH_128_VALIDATED` to obtain a pass.

## Verified evidence and source identity

Read the Windows gate, codec source review, candidate implementation handoff, relevant analysis decisions, and production integration plan:

- `harness/release-analysis-codec-windows-gate-20260911.md`
- `harness/release-analysis-codec-source-review-20260911.md`
- candidate `harness/release-analysis-codec-implementation-20260911.md`
- `harness/DECISIONS.md` analysis decisions and `harness/release-analysis-production-integration-plan-20260911.md`.

The archived Windows debug evidence covers the five-phase lifecycle driver, all six codec tests, analysis 28, numeric 26 and strict core all-target Clippy. The production depth switch remains false. It does **not** establish public source/API persistence, broad legacy regression closure, optimized peak memory, or all mixed-width/partial-value lifecycle cases. Archive `harness/experiments/analysis-codec-windows-20260911` retains commands, logs and frozen inputs; the manifest SHA-256 is `b9c8d1dde3047e2208243536f16357ed8d60da1be8f69512190eaa8e8e241a10`. Its loaded unwind module was not captured; a PATH candidate is not proof of actual binding.

Recomputed SHA-256 of the candidate's relevant current bytes:

| Candidate-relative input | SHA-256 |
| --- | --- |
| `Cargo.lock` | `19499d93dde6f2e2a00ab4b7d5f37689dd7a7d492b2b5e23063a761607839fc5` |
| `crates/oa-core/Cargo.toml` | `3377d3d9d43fe0023ac09728b0d20205f86a6755f15518dc0cd035780b47a95d` |
| `crates/oa-core/src/persistence.rs` | `eda5e697adb29a8bf38b0d367099bd23267455e4792f97607e13dc0b232a3476` |
| `crates/oa-core/src/persistence/json_codec.rs` | `2aa2c52eea794acb85744440192df9ef5193160ad6ebd1febaa824e144aadd90` |
| `crates/oa-core/src/persistence/json_codec/tests.rs` | `7065cc9e177a5699432888110936529c621f13e7c4b164566ab1fd14b61d6b9c` |
| `crates/oa-core/src/language.rs` | `b65098321ecf79e4dc1182a7fab7bafeec0a238bb56153e81782f04fab838558` |
| `crates/oa-core/tests/review_regressions.rs` | `f154e5c88d35e31512e2b07733a1327ea3e2fcfd1ef8eb23066a4e9573f387c1` |

## Why this next step

| Candidate next step | Risk resolved / user relevance | Decision |
| --- | --- | --- |
| Existing public checked-save test | Successful ordinary OA/SA source saves must reopen; exposes an immediate format/parser mismatch with no new harness | **First bounded gate** |
| Existing frozen migrations plus HTTP store restart | Preserves historical OA/SA identity, authored comments, revisions and coupled source/model representations | Follow after identifying/repairing the source boundary; several tests otherwise fail for the same staging reason |
| Mixed Expr width and partial legacy Value children | Tests small-stack allocation/unwind assumptions that five existing phases do not cover completely | Required before broader decoder-profile acceptance; does not fix source persistence |
| Optimized child peak-memory measurement | Calibrates finite cardinality limits against actual deployment resource cost | Required before ratifying depth/profile; no existing archived RSS runner found, and debug/private codec success is insufficient |

The user-facing milestone remains the plan's actual source-authored shared two-parameter calculation and property/check: ModelBaseline 7/4 seconds versus degraded 9/4 seconds, distinct Unbound versus cleared override, identical core/CLI/REST behavior. The proposed one-test gate is an early integration falsifier, not acceptance of that complete analysis feature.

## Reusable follow-on acceptance, without inventing fixtures

After the first result and a separately reviewed source correction, run all three `checked_save_` regressions. The other two already verify exact external draft bytes survive conflict and externally deleted files are not recreated, in both formats:

```text
cargo test --locked -p oa-core --test review_regressions checked_save_ -- --test-threads=1 --nocapture
cargo test --locked -p oa-core --test port_migration --test r6_migration --test r3_migration -- --test-threads=1 --nocapture
```

The migration targets contain 8, 7 and 5 tests respectively. Reuse `examples/legacy-v1-coastal-rescue.oa.json`, `tests/fixtures/v2-coastal-rescue.{json,arcadia}`, `v3-data-contract.{json,arcadia}` and `v4-reviewed-prose.{json,arcadia}`. They cover frozen constructors, deterministic generated identities, collision rejection, strict duplicate/unknown fields, explicit upgrades, no-write loading and source comment preservation. A schema-staging assertion failure must be classified and repaired at its source, not relabeled as proven codec corruption. `tests/language.rs` also already has `v1_text_and_json_migrate_deterministically_without_losing_legacy_semantics`, `malformed_json_never_ignores_duplicate_maps_or_nested_unknown_fields`, and `coordinate_bits_and_permitted_strings_survive_text_and_storage` for deterministic migration, original-stream strictness, signed-zero/subnormal coordinates and permitted text across formats.

For the API boundary, reuse this existing real-transport test after core source closure:

```text
cargo test --locked -p oa-server --test http source_projects::source_projects_upgrade_old_envelopes_without_writes_and_reject_inconsistent_pairs -- --exact --test-threads=1 --nocapture
```

Its old model-only envelope starts at revision 9; opening and no-op replacement preserve exact disk bytes, an authored comment update advances to 10 and persists both representations, corrupt model/source and unstabilized identities reject without rewriting, and restart retains the accepted SourceBundle. `store.rs:116`'s `PreparedProject::new` formats a SourceBundle, compiles it and compares the complete model; thus API acceptance cannot be inferred from the private JSON reader. `http/source7_contracts.rs`'s `source7_http_instance_and_operation_edits_preserve_identity_source_and_restart` adds practical shared procedure, instance and operation-item continuity. None of these existing tests establishes new analysis operations, evaluator semantics or new-definition source parity.

## Missing codec evaluators, bounded after the first gate

Reuse `persistence::json_codec::tests::codec_lifecycle_subprocess` and its existing 128 KiB worker, 120-second child deadline, phase environment variable `ARCADIA_CODEC_LIFECYCLE_PHASE`, and exact child-status checks. The existing phases are `accepted`, `refused`, `malformed`, `ownership`, `atomic`. Do not claim arbitrary new phase names work before extending the dispatch.

1. **Mixed width/depth lifecycle:** add a private child using meaningful mixed If/Binary/Unary/List/Call subtrees, including multiple branches and a populated argument map near logical depth 128. Cover full Project decode, clone/equality, streamed Debug, encode, checked save, reopen and drop, then a just-over-bound input and a valid subsequent decode. Existing shallow per-variant serde checks and balanced-tree typed decode do not exercise this entire combined lifecycle. Keep definition/parameter identities and type assumptions valid where admission is asserted. Also retain exact static-work/node refusal and unchanged-destination assertions.
2. **Partial legacy Value:** use syntactically valid JSON with a legacy version (for example 5), an early wide retained subtree, then a late sufficiently deep subtree within the 512-container raw profile but beyond retained Serde legacy recursion admission. The version probe uses iterative `IgnoredAny` and can reach the materializing legacy stage. A malformed/truncated JSON document may instead fail in that probe and never exercise partial Value teardown. Instrument the intended stage in a private test or directly test the same legacy helper alongside the public decode control; prove the late failure stage. Pair with the deepest accepted Value and explicit iterative discard, plus a valid legacy fixture decode after refusal. Success is bounded normal error/drop, no abort/timeout, and no mutation—not acceptance of the extra unknown field as a legacy Project.
3. **Optimized resource calibration:** the existing release command below repeats lifecycle execution but does not measure RSS:

```text
cargo test --release --locked -p oa-core --lib persistence::json_codec::tests::codec_lifecycle_subprocess -- --exact --test-threads=1 --nocapture
```

Extend a separate Windows runner/instrumented child to retain actual per-child process peak working set/private commit, duration, input/output sizes, exact loaded runtime module and binary identities for accepted/refused shapes. Measuring only Cargo or the driver misses child peaks; sampled RSS is merely a lower bound unless an OS peak counter is captured. Include broad accepted ordinary Project serialization/reopen as well as malformed late allocation, not just raw scanner counts. The profile's 64 MiB input bound, entry/node limits and stack segment sizes are not an RSS ceiling; encoding may retain original/output/reopened models simultaneously. Establish a documented resource acceptance budget before labeling measured numbers a profile pass. No justified numeric RSS threshold was found in the reviewed acceptance records.

The archived executable can help reproduce its exact five debug phases once runtime provenance and authorization are established; it is a lib-test binary and cannot substitute for the recommended integration-test target. Preserve the frozen archive and run new work under a new receipt label. Keep production depth admission conservative until the remaining evaluator and caller-boundary evidence supports changing it.