ARCADIA-Studio/harness/experiments/analysis-source-s0-s1-windows-20260913/evidence/.local/analysis-source8-s1-independent-review-20260913.md

Independent S1 immutable-source review

2026-09-13. Reviewer: Codex-956atf /root/source8_syntax_review, GPT-6 Astra. Parent owns synthesis, integration, compiler leases and Gitea. Review pin: 02b9d5ce4c73d0446146b13b46a228e6fd4d7735, parent 112e0d910bd2b2c9a191f29536fecb0fbc0177b0. All implementation observations below come from git show of that pin, not a mutable working-tree copy. The six-file diff contains 1,345 insertions.

Outcome: no blocking S1 source defect found in this bounded review. This is source-review evidence only: no compilation, tests, timing, memory measurement, native UI, source edits or Gitea writes. It neither establishes executable correctness nor approves public source8 exposure. Read root AGENTS.md, the r2 design and the S0/S1 handoff. Existing semantic types and exact-literal implementation were checked at the same pin. Shared coordination remains the parent's responsibility under the delegated review scope.

Examined invariants

• syntax.rs:159–204,531–550: Pratt continuation uses precedence+1 for the right operand, preserving left association and right-grouped trees. Comparison rejection checks both children; grouping annotates the particular completed node and does not propagate to a newly constructed parent. Source inspection distinguishes 1 - (2 - 3) from 1 - 2 - 3, (1 < 2) == true from 1 < 2 == true, and true == (1 < 2) from true == 1 < 2. The twelve operator mappings match the existing BinaryOp variants.
• syntax.rs:62–156,285–336,433–508; analysis_source.rs:46–88: all thirteen Expr shapes are represented without numeric folding or conversion through JSON/f64. Prefix minus creates Unary; a negative ratio produces Number. Quantity suffixes are consumed only by the literal path, so (1 + 2)[@unit] cannot silently become a quantity with an expression magnitude. Sum requires its initial expression; constructor arity, trailing commas and signed integer Power bounds reject locally. Alias and parameter resolution is deliberately absent.
• lex.rs:16–138; syntax.rs:388–432: a decimal/scientific atom comes from one contiguous raw numeric token. 1e-2 remains one token while 1-2 separates; malformed adjacency such as 1_0, 0x1, 1.2.3 rejects. Ratio components require integer digit tokens with an optional numerator minus, and bounded component lengths precede reconstruction. The reconstruction length constant correctly accounts for ratio(, comma+space and closing parenthesis. Original full literal and component/punctuation spans survive comments; only numeric spelling reaches the shared Exact meter.
• syntax.rs:227–268,367–386: call argument names are checked for duplicate insertion before value parsing. Attempted entries and references are charged before name allocation. Repeated call sites retain separate callee/key spans because spans come from each occurrence rather than a callee/name lookup. This is enough syntax information for subsequent owner/path qualification; it does not itself implement that qualification or rename transactions.
• budget.rs:71–136; lex.rs:17–32: byte/token/entry/reference counters share one explicit Budget across parse calls, reserve before relevant allocation, and cap arithmetic through subtraction before addition. Resource exhaustion latches; numeric admission uses one WorkMeter. Comments consume raw bytes and lexical trivia tokens. No per-literal reset or counter-overflow route was found through the intended methods.
• syntax.rs:48–337,443–479: parser descent is an explicit task/value machine. Frames bound nested syntax; completed Expression children are checked before an accepted parent can exceed logical depth128. A failing proposed parent may own depth128 children, so its teardown has at most the one additional rejected parent layer. Flat binary trees cannot grow accepted depth without that check, and unfinished Sequence/Task containers hold bounded accepted child trees rather than a recursively nested task chain. This structural argument does not replace adverse-input execution and cleanup/RSS measurement.
• language.rs:4–7: the only shared-language delta is the cfg(test) module hook. Existing public header rejection and generic tokenization implementations are unchanged in the reviewed diff. The test-staged raw lexer is not yet a tolerant public tokenizer, declaration grammar or public source8 reader; those gaps are acknowledged S2/S3/integration work, not regressions introduced by this pin.

Nonblocking verification improvements before grammar exposure

1. Assert mixed-precedence topology, not only parse success. At tests.rs:157–169, 1 + 2 * 3 and not(false) and true or false only have successful parsing checked. Those assertions would also pass with several incorrect precedence tables. Add independently matched trees for those inputs and -1 * 2, 1 / 2 * 3, 1 + (2 + 3); check actual operators and child placement. The current implementation looks correct by inspection, so this is an oracle-strengthening recommendation rather than a reproduced grammar defect.
2. Add a flat-binary depth boundary and a deep completed-child failure case. tests.rs:306–390 covers unary128/129, redundant groups256/257 and truncated wide syntax. Add 128 Boolean leaves joined by and (depth128 success), 129 leaves (logical rejection), and a constructor holding a completed depth128 subtree followed by a malformed second argument. These exercise Binary task ownership and teardown of completed deep children, which the existing short-prefix truncation test does not directly cover. Run them under the parent's executable/measurement gate; no stack or performance result is inferred here.

Retained acceptance boundaries

The nine authored tests remain unrun in this review. Full declaration/type parsing, short-word registration, qualified scoped resolution, canonical AST-preserving writing, source indexes/edits, full-bundle aggregate charging, shared strict/tolerant tokenizer composition, old-version migration and guarded save remain outside this S1 pin. The r2 public whole-Project and literal-trivia update oracles remain necessary. Profile ceilings remain candidates pending measured adoption. No conclusion is offered on JSON depth enablement, Linux, evaluator behavior or native/API parity.

Supplement: strengthened test oracles at 2c515cf

2026-09-13, same reviewer. Reviewed immutable commit 2c515cf3bdb3f707beee320be8fed90cffb40757 against its parent e8a18a7; the source delta is 87 added lines in language/analysis_source/tests.rs, comprising a destructuring helper and two tests. Read the reviewed pin's AGENTS.md. Original report bytes above are retained; pre-supplement SHA256 was 08eefcb8870fb3e2f68b04f79d2c095171a976bdeb52c555e19095c840603662. The parent has preserved the original evidence in the versioned harness bundle.

No new source finding. Both recommendations are addressed at the authored-test level. mixed_precedence_and_grouping_have_independent_expected_child_topology checks exact operator/leaf placement for multiplicative-over-additive, unary-over-multiplicative, And-over-Or, equal-precedence left association and grouped right addition. Expected structure is written directly, not obtained from parser precedence metadata or a formatter. flat_binary_depth_and_malformed_constructor_retain_bounded_completed_children correctly expects 128 Boolean leaves under left-associated And to have depth128 and destructures all 127 Binary nodes, checking every right leaf and the final left leaf. The 129-leaf case reaches logical-depth rejection independently of frame/list ceilings.

For sum({deep}, @), the first argument completes as depth128 and is owned by the pending Sequence before the second argument's reference name is rejected at ). Sum construction has not happened, so its potential depth129 does not preempt the intended cleanup path. The exact error and closing-token span discriminate this failure; the subsequent fresh parse is a useful recovery control. Runtime completion is still needed to establish that the teardown actually survives. No compiler, test execution, production source change or Gitea write was performed by this reviewer; original public-exposure and measurement boundaries remain open.