ARCADIA-Studio/harness/release-analysis-core-iterative-review-20260911.md

Independent iterative analysis-core review — 2026-09-11

Codex-956atf /root/analysis_core_review; bounded independent source review assigned by root. Reviewed isolated .local/analysis-core-worktree-20260911, branch codex/analysis-core-20260911, HEAD b96ff3935ab3f36b7144566e46559a05a29292a5 plus the frozen corrections below. Ownership: this new report and named Gitea issue1 review comments only. No production edits, Cargo/rustc, test execution, native/WSL/network diagnosis, Git mutation or further delegation. Read AGENTS, current issue1 coordination, empty open-PR inventory, Wiki AnalysisCoreSchema820260911, isolated source handoff, and root numeric/decoder reviews. Review ownership is issue1 comment341.

Verdict

No material new correctness or resource defect found in the iterative typechecker/admission corrections. The continuation machine preserves the prior checker semantics while removing expression-depth-dependent Rust recursion. Admission's new precharges bound the newly covered variable-width walks before their queue growth or scans. This is approval of this bounded source correction, not full schema8 transport/evaluator/source8 or release acceptance.

The reviewer independently read root's preserved depth, full-analysis and numeric logs. They record the required depth128/129 and definition-call32/33 pass, full analysis:: 28/28 (25 schema8 plus three existing topology tests), and numeric26/26, all with no ignored tests. These are root's actual executions, not executions by this reviewer. Root reports the normal Windows test stack with no override. Strict all-target core Clippy was still pending when this review began; obtain its terminal result separately.

Source reasoning and concrete checks

Paths in this section are relative to the isolated worktree.

• crates/oa-core/src/analysis/typecheck.rs:103: the root frame starts at logical depth1. Every Child result pushes exactly one borrowed-expression frame after the128-frame check. On attempting depth129, the rejected entry event is charged before returning the depth error, matching the old checker entry precedence. Complete checks that frame's expected type before handing exactly one result to its parent. An Enter state consumes no child; each suspended state is resumed only after one completed child. Frames borrow Expr/calculation bodies and contain fixed-size resolved types using the two-UUID KindHandle; their destruction does not drop the stored Expr tree.
• typecheck.rs:152, :254, :388: reviewed every state against the original recursive implementation. Binary checks left then right before the operator; If checks Boolean condition, true with the surrounding expected type, then false with the true result type. Unary Not constrains its child to Boolean. Sum checks initial numeric/non-affine eligibility before the values list, then validates additive algebra. Power checks the child before the exponent's type rule. AsKind resolves its kind before its child. Final expected-type equality remains common to every completed expression. No branch is skipped based on its Boolean value.
• typecheck.rs:204, :302: lists carry the inferred or expected scalar type to the next item and retain no item-result array. A contextual empty list succeeds, an uncontextual empty list fails, and nested lists fail. A completed If cannot bypass false-branch equality because that child is checked before IfFalse returns the saved true type. Context propagates through nested If and typed call arguments; it does not introduce backward inference from a later branch where the previous implementation had none.
• typecheck.rs:335, :388: Call arity rejects in constant work. The complete declaration-key scan is precharged before contains_key; each argument lookup/type resolution is separately charged before scheduling that argument. Parameters are consumed in declaration-vector order, using exact scoped IDs. Zero-parameter calls complete directly; the last argument resumes once to resolve the result. There is no call-body expansion in these frames: definitions are checked independently and the iterative graph enforces definition-call depth. Duplicate parameter IDs are still rejected by binding admission. The map indexing is preceded by the unchanged exact-key membership check over the same immutable map.
• crates/oa-core/src/analysis/admission.rs:219: the structural walker counts current, previously visited and pending child slots before adding new children; each slot corresponds to a distinct owned tree node. The65,536 bound therefore rejects an already oversized tree without rejecting a fitting tree merely because it has both visited and pending nodes. Width checks and the full child-slot charge precede variable-width iteration/push. It preserves left-before-right, condition-before-branches and initial-before-values traversal. Structural Call arguments remain UUID-map ordered, as before; subsequent semantic checking is declaration ordered. Thus declaration order is the semantic checker rule, not a claim that all structural errors in an entire Project are reported in that order.
• admission.rs:427: metered relation-layer traversal matches Project::layer_of (model.rs:1843) for existing elements, relation sources, missing endpoints and repeated IDs. It charges each hop before set insertion/lookups. The existing malformed-chain tests appropriately establish bounded failure behavior before architectural validation, without treating malformed relations as admitted architecture.
• admission.rs:127, :193, :473, :722: definition text, unit symbols, scoped parameter names and initial closure entries are charged before their scans or pushes. Dependency expansion already charges each queued edge and each popped entry; duplicates consume events and cannot create an uncharged queue. The total queue/work bound here is the aggregate static-event ceiling, not necessarily the number of distinct closure definitions. Budget still atomically refuses an unaffordable charge and latches exhaustion. Fixed-size map/type operations and fixed bounded Exact values retain bounded per-event cost; this is not a wall-clock or RSS calibration.

The authored tests make declaration order observable with two distinct errors and swapped parameter order (tests.rs:641), and binary order with swapped invalid operands. tests.rs:898 tests unary128/129, mixed Binary/If/Call/Power/Unary128/129, contextual list If/Call128 and call graph32/33. Meter tests cover1024-wide child queues, exact64-key/64-argument charges and64-hop relation chains; the actual root full-filter log records their passes. This coverage is substantial but not an exhaustive differential execution of all possible continuation states: deep Sum/AsKind combinations and arbitrary exact-budget failure points were reviewed by source reasoning only.

Frozen identities and execution evidence

Independent file SHA256 readback matches the assignment:

Source	SHA256
crates/oa-core/src/analysis/typecheck.rs	831F14346BBAE83FBDEEB744F9F29460FAB13A8315645FAA6CE94D0B60B1516F
crates/oa-core/src/analysis/admission.rs	5F85EAA868AC43C4819C98556281D8226F9C0E2A4B11E5C97CF24D855D2127AE
crates/oa-core/src/analysis/tests.rs	9FB30B28E305CB00E7C39204912F8311E96AA92D0334CE4A73FB08FADDFE83C5

Root's immutable .local/analysis-core-iterative-gate-20260911/manifest.json ties the working inputs, not HEAD alone, to its saved test binary. The manifest records binary SHA256 2B4EE8BA63B20415B352E084314CC7504E778C093598B9564C6EA4F56BC921C9, depth-log E674A125D29476654C4EFB9E6F26171E4F292B8EEC50E046324B5B9EE57F0F33, full-analysis-log BAEA48F52054FF2506D49ABD4C3778E8E6FBEC3810ACA0383A55C9D13FC58C64 and numeric-log 102B5B9600E9CB0C74333669FCB4EA87D59B27E37A12549E86DC429DD6DEDF64. Reviewer read the logs/manifest and source hashes; the saved executable was not run or independently rehashed here. The first failed gate remains preserved separately; it is not erased by the successful replacement.

Follow-on gates and uncertainty

Root must record terminal strict core Clippy and preserve source identity across any resulting correction and integration. The source handoff/Wiki still said "awaiting rerun" at read time; root should update their current-status sections with the actual gate evidence while preserving the historical failure. No additional source fix is requested by this review.

The aggregate1,000,000-event profile still needs its separately promised target memory/time calibration. Full schema8 admission-to-save/reopen, all external codec boundaries, recursive ownership/lifecycle, output-size closure, source8, evaluator and broader product acceptance remain the existing independently documented gates in harness/release-analysis-decoder-review-20260911.md and the schema8 handoff. The default Serde recursion guard remains deliberate. This review does not reclassify those known limitations as new defects in the continuation correction, and the successful Windows in-memory depth test does not close them.