ARCADIA-Studio/harness/experiments/analysis-mixed-emission-20260925/TEST-REVIEW.md

Independent emitted-unverified test review

2026-09-25. Ready for compiler/runtime gates after two pre-execution fixture corrections; no remaining source-review blocker found. Reviewed frozen uncommitted tests over fa7a980418ef99d772e67c66c28dfa7b5181f875, selected contract SHA256 2bb0f15ee6a97ca88bc3bfa55e7ae8c830ce389ed05aee879465cd66977cd701, and independent EMISSION-ORACLE.md SHA256 d825345060bf3ef9b1388c59f3804d190e2de8f68b0f4c3c24caae05a9acaea5. No Cargo or application execution. Literal byte inspection is not a reported parser/emitter pass.

Paths under crates/oa-core/src/language/analysis_source/mixed/:

Frozen file	SHA256
project/ordinary_index/rename/emission/tests.rs	a31471c4afff4326e72360d838a970baf2a6a5964a478e6641850c6ba6511e57
carried/tests.rs	0bc222783bf55e30917932f169891ebcd16d9e202abfeda67fb3a33d66ec7bb8

Ten new tests live in the emission module; one appended carried test is named emission_refuses_changed_carried_even_zero_and_preserves_noop_guards. A focused emission substring includes all eleven, whereas filtering only the emission module would omit the guard control. Existing ordinary-index and rename test files are unchanged from fa7; the carried file only appends the new control. Production remains the reviewed hashes in SOURCE-REVIEW.md.

Resolved pre-execution findings

1. Initial test SHA256 259ada3b0bf5e1e8e01d6202a9625760ce8fb78f390e9010f3e083db114183e8 gave the policy/lifetime fixture private bytes2048/references31 but caller bytes2000/references29. Existing parse_with_profile rejects that widening before emission. Reported directly; repaired caller values are bytes3000/references37, preserving distinct all-field comparisons and the original private profile. No admitted Budget was mutated and no production rule was relaxed.
2. Initial category expected output converted every LF to CRLF, but the unchanged original fixture contains mixed newlines: only two CR bytes and thirty LF bytes. Independent literal comparison against the existing 36-row physical oracle failed. Implementer independently identified the same issue and repaired only the expected literal's comment boundary and final newline. The original fixture, numeric edit tuples and output-size expectation remain unchanged. Final expected output equals all 36 independent original-coordinate replacements byte-for-byte: 2145 bytes, SHA256 120daee4fcb5f524e071cf8793d0f0c7d174c448bd69b0cba2fd4022a8ffb3e3. Original fixture SHA256 remains 3943579866157c7b5d95ce9edcb2d643058826b9af44257557e2864f130d15fc (2152 bytes).

These are source-review fixture corrections, not failed Rust runs. Their initial incorrect expectations are recorded here rather than presented as successful evidence.

Oracle fidelity and coverage

• Real overlap boundaries: E and H construct policy before actual parse/resolve/index/plan. The tests assert L=(16,0,9) and (26,0,33), then exercise exact entries/text caps17/114 and29/216, lowering one coordinate independently. Output O=(1,0,105)/(3,0,183), whole file maps, desired pointer, E0 and exact policy are asserted. Predecessor unwraps ensure a late-boundary claim cannot silently pass because an earlier phase rejected. Failures require entry/default location; production/source reasoning identifies the upfront reservation as the only remaining cap check.
• No-op identity/lifetime: E caps16/78 and H26/132 are below output-copy overlap. Returned owner retains original bundle pointer, allocated catalog-name pointer, Slots, Usage, numeric usage and warnings. Desired is local to an inner scope and drops before the returned source is used, providing a compile-time lifetime control. Source review separately confirms the branch precedes any output allocation.
• Stale/wrong branch/validator: both wrong branches refuse. Entry change, untouched/touched edits, missing/extra files and renamed path all fail complete-current validation for unchanged and changed intent. An independent equal current bundle succeeds. Missing required edit, an extra unchanged-target edit and a nonempty/range corruption control exercise existing validation before transitions; direct output_slots(usize::MAX) is explicitly arithmetic fault injection. The unchanged planner tests retain wider target/overlap/UTF-8 corruption coverage; duplicating every existing validator case is unnecessary.
• Policy and pending lifetime: the repaired all-field fixture compares all six Limits values and all seven ProjectLimits/model values. Its original source bundle is local to a scope that returns Pending, proving pending cannot retain the old source lifetime. No constructor/profile mutation is used after admission. Desired remains external.
• Rich full bytes: independently authored entire output files cover OA/SA global and scoped swaps, reordered/repeated call labels and cross-file references. Literal byte counts independently read back as OA213+213+474=900; Unicode/CRLF226+226+491=943; SA213+213+548=974 and226+226+565=1017. Every case asserts complete bundle equality, E15 and retained text S+42, not merely selected substrings. The expected literals do not use plan edit iteration or emitter output. Original Project and desired remain equal to their independent/reference fixtures.
• Four-file cross-family swap: literal input/output maps match the oracle f↔w swap, including comments with unchanged spellings, a leading multibyte character, CRLF, references, complete untouched file, keys and entry. Output S467 plus47 key bytes plus12 entry bytes gives O=(4,0,526); E2 is asserted.
• Complete ordinary categories: the repaired expected whole file covers all 36 independently authored physical edits, line-comment-separated reference trivia, implicit parent relationships, display/prose text and historical UUID exclusion. Output2145+key12+entry12 gives retained2169, F1 and E0. Exact literal comparison used the previous independently authored numeric map, not the new emitter implementation.
• Combined grow/shrink: the 31-byte node alias shrinks to one byte while three occurrences of f grow to renamed_f. Independently authored complete output is924 bytes, including the unchanged b.arcadia, and O.text966. This is actual output construction under sufficient inherited text allowance; the test does not misrepresent the older930-byte source-size planning cap as sufficient simultaneous live-text capacity. The existing933-byte planning negative remains in unchanged planner tests.
• Carried restriction: appended test uses both Some borrowed-zero and real retained input. Changed emission requires the exact legacy-syntax refusal at original entry0..0. No-op retains original bundle identity across another no-op plan, then a changed attempt still refuses, discriminating against losing the guard. Captured carry remains zero or the real owner count; held source bytes stay unchanged. This is not fabricated nonzero occurrence provenance.

Stack scope and pending gates

The final scoped test extends the original minimal success/no-op/late-byte-refusal controls with the established 127 nested abs calls (E128) and128-item list (E129). Complete source owner, desired and plan are prepared on the normal thread. The entire plan then moves into a128KiB scoped worker, where changed output is checked/dropped or the unchanged owner is checked/dropped. Deep/wide expected bytes are authored from the fixed body with only the project alias changed; E and original bundle preservation are asserted. This exercises destruction under the new emitter frame without moving prior parser setup out of any old full-pipeline test. The new test has seven worker cases; no existing stack allowance/expected behavior was weakened.

Compilation must establish privacy/borrow/lifetime correctness. Focused gates must actually include all eleven new names. Full comparison must preserve all258 prior named outcomes, sixteen inherited failure bodies, formatter disposition and existing stack controls; no completion or unchanged-runtime claim follows from this review. The independent literal checks cannot certify no arbitrary allocator failure or universal stack bound. Passing emitted-unverified tests would still not demonstrate actual-output parsing/admission/equality, accepted-result ownership, public editing or persistence.

Committed readback

Commit 19a4082117b88caf332198e4c685bde91005cb52 matches both frozen test hashes above and the two production hashes in SOURCE-REVIEW.md. No test or production change occurred in this report-only readback; runtime gates remain pending. The irrelevant record-limit parenthetical was omitted from the repair narrative without changing any tested value or expectation.