ARCADIA-Studio/harness/release-analysis-core-schema8-wip-20260911.md

Schema8 core source handoff

Current root execution and review — 2026-09-11

Root completed the corrected required depth128/129 and call32/33 regression (1/1), the complete analysis:: filter (28/28:25 analysis plus3 topology), numeric26/26, and strict core all-target Clippy with -D warnings (exit0,3m37s). The default Windows test stack and required limits were unchanged. Independent analysis_core_review found no material new correctness/resource defect in the iterative checker/admission correction; Gitea342 records its conclusion. Source hashes match the correction freeze below.

Root's durable harness/release-analysis-core-iterative-gate-20260911.md and harness/release-analysis-core-iterative-review-20260911.md record execution and independent scope. Immutable root .local/analysis-core-iterative-gate-20260911/ contains274-input manifest SHA256 28D6CEAE5C52765F5DB5CB411D7E42EDAB91359C9E351663315BC4B7F1FF2B7A and corrected test executable SHA256 2B4EE8BA63B20415B352E084314CC7504E778C093598B9564C6EA4F56BC921C9. Clippy log SHA256: 6FE529BBA6A761FEDACB1A3933BB86E4FB644D8CC192F57FB0F45EFA5B9ABFFF.

This supersedes the awaiting-rerun status below, preserving the first actual failure. It does not close full core integration, bounded codec/lifecycle/output, source8, evaluator, UI/REST/CLI parity, libraries or release acceptance. The source remains isolated from root's runnable schema7 application.

Historical stack-overflow correction source freeze — 2026-09-11

Codex-956atf /root/analysis_core_resume, renewed debugging lease after root's actual first Windows gate. The same dedicated worktree/branch remains at HEAD b96ff3935ab3f36b7144566e46559a05a29292a5 plus uncommitted corrections. The first candidate failed; this replacement is frozen source awaiting root's rerun. No compiler was run by the worker.

Root's original cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1 compiled warning-free in3m34s, discovered28 tests, logged16 named passes, then aborted at analysis::tests::logical_depth_and_call_depth_have_exact_boundaries with Windows STATUS_STACK_OVERFLOW / 0xc00000fd. Preserve the original root .local/logs/analysis-core-first-20260911.log (SHA256 84C6B63039472363412B66C7A24DE825A846518725EC9F7436C252603AEF54FC) and root-reported binary target/debug/deps/oa_core-a7a95d666500007c.exe (SHA256 548850D3606C9B4A58859677E86A1C1813EB6E71785C529F771E04125E7A33AF). Gitea issue1 comment305 records the actual failure. Neither compile success nor the16 earlier passes establish a full gate pass.

The test-count discrepancy is resolved: Rust's substring filter analysis:: selects25 schema8 tests plus three existing topology_context::analysis::tests, declared through topology_context/analysis.rs into analysis_tests.rs. The earlier prepared25 was the schema8-module count, not the full filter count; the saved22 would likewise have selected25 with those topology tests. The current corrected filter still expects28, with no ignored/removed or additional test functions.

The large recursive Checker::expression was the concrete source-level suspect; no profiler/frame-size measurement established the exact abort instruction. It is now an explicit continuation machine with at most128 heap frames and one returned type. Each frame borrows its Expr and any calculation definition and owns only fixed-size resolved types/handles. Lists and calls schedule one ordered child at a time. The rejected129th frame is never allocated, while its entry event is still charged to preserve failure precedence. Rust call depth no longer scales with Expr depth, and typechecker-frame destruction does not destroy the borrowed Expr tree.

The continuation states retain left-before-right operands, condition-before-both-branches, Sum initial-before-values, AsKind target resolution-before-operand, declaration-order call arguments, contextual empty-list typing, branch type equality and existing node/key/argument meter precharges. No numeric operator semantics, fixed KindHandle, lowerable1,000,000-event ceiling, accepted128-depth bound or stored schema was changed. No stack-size override, release-only workaround or ignored test was introduced.

The original failing test now includes diagnostic phase markers and unary128/129, mixed Binary/If/Call/Power/Unary128/129, contextual empty-list If/Call128 and definition-call32/33 boundaries. The existing parameter-purity test now makes call declaration order versus UUID order and binary left-to-right error precedence observable through distinct invalid-reference errors. The already compiled meter tests retain their exact event expectations.

Path	SHA256 at correction freeze
crates/oa-core/src/analysis/typecheck.rs	831F14346BBAE83FBDEEB744F9F29460FAB13A8315645FAA6CE94D0B60B1516F
crates/oa-core/src/analysis/tests.rs	9FB30B28E305CB00E7C39204912F8311E96AA92D0334CE4A73FB08FADDFE83C5
crates/oa-core/src/analysis/admission.rs (unchanged since first candidate)	5F85EAA868AC43C4819C98556281D8226F9C0E2A4B11E5C97CF24D855D2127AE

Standalone installed rustfmt2024 check and git diff --check pass for the correction. Root's next commands from this worktree, using its established toolchain/cache:

1. cargo test --locked -p oa-core --lib analysis::tests::logical_depth_and_call_depth_have_exact_boundaries -- --exact --test-threads=1 --nocapture
2. cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1 (28 expected).
3. cargo test --locked -p oa-core --lib analysis_numeric::tests -- --test-threads=1 (26 expected).
4. cargo clippy --locked -p oa-core --all-targets -- -D warnings.

Admission's structural Expr/reference walks and dependency/case graphs are already iterative. Inspected architectural index construction borrows analysis records and clones only ordinary step-ID vectors; its analysis-reference branch avoids cloning Expr-bearing elements. This identifies no further recursive Expr traversal in the immediate admission path, but is not execution or stack/RSS evidence. Derived Expr Clone/Debug/equality/Serialize/Deserialize/Drop, partial decode teardown, command cloning, output expansion and full codec/lifecycle/source parity remain the separately documented production risks. Default Serde recursion rejection remains unchanged. Root owns execution, follow-up findings, integration and release publication; there is no complete schema8 transport or release claim.

Historical first resumed source freeze — 2026-09-11

Codex-956atf /root/analysis_core_resume, resumed by root after the user returned. Source frozen for root's first compilation gate; still uncompiled staging. The dedicated worktree remains C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-core-worktree-20260911, branch codex/analysis-core-20260911, HEAD b96ff3935ab3f36b7144566e46559a05a29292a5. No commit was made by this worker. The reboot record below is retained as historical evidence; this section supersedes its stopped/pending-static-review status only.

The resumed delta changes three Rust files plus this report:

Path	SHA256 at resumed freeze
crates/oa-core/src/analysis/admission.rs	5F85EAA868AC43C4819C98556281D8226F9C0E2A4B11E5C97CF24D855D2127AE
crates/oa-core/src/analysis/typecheck.rs	1AC3A92E97B886F4BFAC31BA22C182347131D0A82BEDBF6B2F2073D02AD5A6E4
crates/oa-core/src/analysis/tests.rs	9EC9C12C618600039BC2DC0A9B9BF6DC5378FD4D8749E21EDEC699EEE06AB0E2

• admission.rs precharges expression child slots before queue growth, rejects visited-plus-pending closure overflow before allocation, meters initial closure queue entries, text spans and scoped parameter names, and charges each relation-subject traversal hop. Known indexed element layers use direct map lookup. This closes analysis-specific unmetered work; it does not bound the existing architectural validator, wire decoding or recursive lifecycle operations.
• typecheck.rs groups owner/field/layer/parameters in BindingContext, removing the eight-argument helper. Call arity remains an O(1) check; the complete scoped-key scan is precharged before lookups, then declaration-order argument lookup/type work is separately charged. Actual parameter identity and all-branch checking are preserved.
• Three new meter tests exercise 1,024-wide List/Call precharge, a 64-parameter malformed/valid Call at exact work boundaries, and 64 relation hops with terminal element/missing/cyclic endpoints. The existing real-Project aggregate-limit test also checks text-byte accounting and exhaustion before invalid text inspection. These relation-chain fixtures deliberately test malformed input before architectural admission, not newly accepted architectural relations.

Expected focused count is now25: the saved22 plus three new meter tests (21 actual-Project tests and four meter tests total). Command from this worktree: cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1. Root owns the toolchain/cache configuration and all execution. Follow with the changed numeric-helper regression filter analysis_numeric::tests, then strict core Clippy; the earlier26 numeric passes apply to7d14bd0, not this schema8 candidate.

Read-only review covered existing persistent-enum/Project constructors, command/reference call sites and the analysis lifetime/borrow paths. Standalone installed rustfmt --edition 2024 --check passes for all three changed Rust files; git diff --check is clean. No Cargo/rustc, test, Clippy, native, Linux or memory/stack measurement was run by this worker. No root-checkout files, manifests, lockfiles, ledgers, fixed KindHandle, numeric semantics or other worktree-owned source changed during resume.

The lowerable aggregate1,000,000 static-event ceiling, nominal/exact arithmetic, baseline/case/unused-branch checks and scoped parameters remain settled. Default serde_json recursion rejection stays enabled. Schema8 codec/allocation/output/lifecycle closure, source8, evaluator, package environment, capture, API/CLI/UI and historical/transition parity remain pending; this is not a runnable release or complete product transport. Gitea issue1 comment291 records the resume lease; root owns integration/publication and any subsequent compiler-driven corrections.

Historical reboot freeze

Codex-956atf /root/requirements_delta, 2026-09-11. Frozen immediately at the user's reboot checkpoint; uncompiled work, not a runnable product. Do not resume without root follow-up after reboot.

Worktree: C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-core-worktree-20260911, branch codex/analysis-core-20260911, base 7d14bd0dd1cf4a2293c00c185573fd4a7fc364ae. All edits in this assignment are in that isolated worktree. Root retains commits, pushes, builds, integration and the original checkout. No manifests, lockfile, source8 grammar, evaluator, server/CLI/UI, generated schemas, ledgers or prior frozen reports were edited.

Coherent implementation present

• Schema8 Project.definitions is required. Local quantity-kind, unit and pure calculation definitions share global UUID/alias/header identity; ParameterId is scoped to its calculation. DefinitionRef::Local is the only admitted reference variant. Imported packages are not simulated.
• Three explicit SharedBody records implement property-owned bases, subjectless or subject-bearing one-level cases, and shared checks. Binding::{Unbound, Expression} has no persisted Clear/default-case state. The closed expression/type vocabulary is in analysis/types.rs.
• analysis::admit(&Project, AdmissionLimits) returns the resolved kind/unit/calculation environment, accepted limits and usage. effective_binding(property, ModelBaseline|Case(id)) returns the selected binding and its origin; it does not evaluate. Private bounded KindHandle contains project and definition UUIDs and is valid within one admitted environment.
• Static checking uses pure NumericType result helpers also used by NumericValue. It checks every stored branch, pure parameter scope, exact call arguments, declared/display types, same-layer subjects/property reads/case targets, affine kinds/units, flat homogeneous lists, acyclic calculation/effective-property dependencies, logical depth128, call depth32 and stored closure65,536. Checks may be Boolean false; supported runtime domain failures such as 0/0 do not become typing errors.
• Root ratified the provisional static ceiling1,000,000 events, explicitly lowerable and separate from runtime work. One meter spans the document and every effective case; it latches on exhaustion. Final ceiling acceptance still needs a measured gate. This meter is analysis work accounting, not a bound on all existing architectural validation or JSON allocation.
• Commands add Create/EditDefinition, SetAnalysisBase, SetAnalysisOverride and ClearAnalysisOverride. General element creation/editing remains the actual shared command path. Reidentification rewrites property/local-definition references and case keys, preserves scoped parameters, and rejects colliding keys before mutation. Deletion retains live analysis dependencies, so the same transaction must repair or remove them. Existing Session history/provenance is reused.
• Frozen schema5/6/7 JSON envelopes migrate with an empty catalog and reject new fields/kinds. Existing descriptive units/constraints remain strings. language.rs contains only old-source compatibility/refusal and record-count glue. Explicit guards refuse header-only semantic review or transition of analysis records.

Evidence and remaining risks

**22 tests are prepared, zero were compiled or executed by this worker:**21 actual-Project tests and one static-meter test. The independently specified complete17-UUID response-budget fixture covers shallow JSON reopen, base/case/Unbound selection, commands/history, identity domains, atomic deletion repair, case-only cycles, unused branches, parameter purity, types/units, R6/runtime agreement, lists, logical/call/closure boundaries, aggregate static work, transport record counts, closed wire input, old-schema metadata preservation and unsupported review/transition refusal. The expected mixed-unit evaluation totals are not claimed; there is no evaluator in this lease.

Standalone rustfmt parsed/formatted the new modules, migration_v7 and changed numeric quantity file. A read-only git diff --check before the stop request was clean. Neither is a compile/test gate. Root reported the earlier numeric foundation at7d14bd0 passed26 tests; that result does not cover this WIP or its modified numeric helper code.

The default serde_json recursion guard is deliberately unchanged. Some programmatically admitted depth128 trees cannot reopen through the current decoder. Pretty serialization can exceed64MiB while semantic node limits still fit. Header Value allocation and per-Exact String/BigInt decoding precede aggregate static admission. Clone/Serialize/Debug/Drop and command cloning need the coherent bounded-codec/lifecycle gate. See the independent decoder review harness/release-analysis-decoder-review-20260911.md in the original checkout (Gitea#257). Do not publish a runnable schema8 product before codec/output closure.

Source8 parsing/formatting/update/history parity is pending: the model/schema header is8 while the existing source parser still accepts only3..7. Existing full source regression tests therefore cannot be represented as passing. Old synthetic tests that serialize a current Project after merely changing its schema number may need to remove the new catalog field to represent a real frozen old envelope. Generic factory creation refuses analysis kinds because required semantics cannot be defaulted.

Compiler/borrow/exhaustive-match checks remain outstanding. Static review was interrupted: the private typechecker binding helper has8 arguments and may trigger strict Clippy's argument-count lint; grouping its located binding context was the next cleanup under consideration, not applied. Review the static event precharge coverage of the call-argument arity/key scan before treating its weights as final. Existing architectural validators still have their own scaling costs. No claim of full decoder safety, source parity, frozen export, package compatibility execution, approximate mathematics or finished release capability is made.

Exact edited paths

All paths below are relative to the isolated worktree, not the original checkout. This report is the only additional edited file beyond this20-file inventory.

Path	SHA256 at stop
crates/oa-core/src/analysis.rs	7C197D80CD6C5A17345E9ABD20107CF9EE1887A77596144A8FAADB3253A9664B
crates/oa-core/src/analysis/admission.rs	60661ADEBFBDFA2A04A354A106D3DB3F81821EF4A50786A6CF611988666FDB85
crates/oa-core/src/analysis/references.rs	FE50EDC049B9900D91CADE3F58D15ACA4101211C39BB090317F548259D634529
crates/oa-core/src/analysis/resolve.rs	67AAA97DA8190DEDE71F0E2F98F1884A1DA38596B4B2DC6F8D61FF4377BDC80F
crates/oa-core/src/analysis/typecheck.rs	23F13E0EF971E794210FB3886178E1145661E4BC668A50B753F7BAAA9591035E
crates/oa-core/src/analysis/types.rs	CFD03E2B01D34AE6979403458D9861B7B1252383A2313CB56133AB64167F72B2
crates/oa-core/src/analysis/tests.rs	7137A47E994E629D7F349D023F32C10FD0563261678E59878A23E3BF6A101F05
crates/oa-core/src/analysis_numeric/quantity.rs	B9F23A9485F8BD913722023C35FB9D8917C9F160078655B3A5C52C8F7F12AB94
crates/oa-core/src/language.rs	B65098321ECF79E4DC1182A7FAB7BAFEEC0A238BB56153E81782F04FAB838558
crates/oa-core/src/lib.rs	C9BF3462A57A465B6CC7ECD7866E0D331B35F299E89D9C917E0A4587BB1DCD89
crates/oa-core/src/migration_v4.rs	BF4056DA11AC4F27627320742539CC2408ED42334106F3068C432FF70C62DB25
crates/oa-core/src/migration_v7.rs	474F4CEBDD343A7EECDF243149BBCBF08E12EAA05B8532BF2593705287017B30
crates/oa-core/src/model.rs	1C06BCC4AA7ABFEF89876C3A001171C742558D664612CF36152AC0AA52BC7BAF
crates/oa-core/src/persistence.rs	30B05FA464C49629080F3E20C6D3DA5226858A99B7C4C9554356847F8A5975EE
crates/oa-core/src/references.rs	63CD8655F67D919CC8F6B796F4CEC42D7B020AA37880E50F19190AAB8B0029A3
crates/oa-core/src/semantic/catalog.rs	47D74ACC4862139BA835DB3D6B769411E27860A99426A7F03EDEA26F44F7F7B3
crates/oa-core/src/session.rs	06115011BC86F0C95BBBE6D14BDAEDD7B83A66C0104DB186900B0F047B0F9C43
crates/oa-core/src/transitions.rs	127E429BCA4B2EA9A189ECE7E7B6DFD05A30B5FDEE98B2D10288A6F7C17B5931
crates/oa-core/src/validation.rs	E4C61F5ABB22AE3E595E16E93472E4364CDE4DB9064EC6DF826228C3D5962E42
crates/oa-core/tests/source7_contract.rs	0702D3BD0173DEF4F67770458E4AF2B23F213FD5938EE70E3AE0042897EF5F1E

Next authorized gate after reboot

Root first preserves/pushes this WIP and confirms the exact checkout. After root explicitly resumes work, the proposed narrow root-owned command from this worktree is cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1, using the established toolchain and root-selected target directory. Fix actual compiler/test findings, rerun modified numeric tests, then strict core Clippy; only then continue independent review and coherent bounded codec/source8/evaluator integration. This worker has not run that command and will remain stopped.