ARCADIA-Studio/harness/release-semantic-proposals-review-20260910.md

Independent review of the paired analysis and library proposals

Codex-956atf /root/semantics_critic, resumed 2026-09-11. This is a design review, not an implementation test or release acceptance. Read the full revised objective in attachment a49d1780-25d5-4778-ad68-6140c60e4207, both proposals, the requirements delta, Gitea issue #1 through #102, the empty open-PR list and Wiki Home. Ownership is recorded in #103. Wiki Home describes an older checkpoint. Another host's earlier comments do not establish current activity.

Owned output is this file only. No production or ledger edits, Cargo, native application input, commits or pushes. Root was integrating unrelated behavior/packaging changes while this review ran; inspected semantic boundaries remained unchanged. Source HEAD observed during review: 865cd55e21e622985322d711b23e6d653b563d3d.

References below use A for analysis proposal and L for library proposal. Line numbers identify the versions initially reviewed; section names and quoted concepts identify the locations if the authors add follow-up text. Both explicitly remain proposals. A deliberate exclusion or unfinished experiment is not reported as a shipped defect. P1 means a contract decision or required workflow must be resolved before the relevant production foundation is ratified; P2 means a concrete design weakness or incompleteness to resolve before acceptance.

The analysis author revised and froze A during review. Re-read its new section 3.4, exact literal rules and compatibility discussion. Final observed SHA256: A BF631450F46FF19AA09D142B964B60FA380309E4A728F895D1ECEC3ECBF6EF41; L 29687171ED01FE4A5A8C2F3B3493008C144189D44349524CDFF825862D41BE72. R7 is corrected at proposal level; R2/R4 are now explicitly acknowledged consequential choices in A. That acknowledgment improves the proposal without resolving the choices.

Recommendation

Keep the pure evaluator, typed expression references, exact package pinning, editable materialized architecture, explicit bindings, complete old instance baseline and atomic document admission. These are compatible foundations. Do not ratify the entire paired design yet. In particular, byte-level package identity must not accidentally become the only available engineering compatibility policy; and a source export with omitted management records does not demonstrate text-only authoring.

The strongest immediate comparison is a compact direct-value/baseline design with one explicitly based alternative case against A's complete-case design, using both authored text and the native workflow. For libraries, retain materialized patterns, but decide the cross-revision definition policy and source creation/update normalization before committing to the hybrid mount implementation.

Findings

R1 — P1: the source example omits the information needed to author a managed instance

Locations: L, “Textual source and portable admission,” lines 145–175, especially the comment at 165; “Proposed persistent model,” lines 112–139. A, “Minimum GUI and source work,” lines 192–203. Existing contract: docs/language.rst:1772–1781; crates/oa-core/src/source_project.rs:286; crates/oa-server/src/store.rs:116–130.

The library example names an import, export, binding and member, then replaces the exact baseline/correspondence with a comment. Those records are authoritative for future updates, not optional display details. The proposed portable envelope solves transport and offline availability, but does not specify how an engineer creates, updates or repairs those records using text alone. A full serializer grammar would establish expressiveness; requiring users to hand-copy the old typed graph, identity map and lineage still fails the new low-clutter authoring criterion.

Minimal falsifier: start with an empty project directory and an available package, without a GUI or preexisting instance. Write a readable declaration for two instances; normalize/compile it; edit one local occurrence; upgrade that instance to a new package while retaining the edit. The proposal currently has no specified text operation that creates the complete baseline and no complete example of the update. Supplying a GUI-generated snapshot as the starting point would evade this task.

Smallest convergence: distinguish a concise authored creation/update request from its accepted, fully explicit normalized state. A Rust source command may allocate/stabilize IDs once and emit a declared, version-controlled management module containing the exact base/map/lineage. Specify when this happens, how repeated compilation stays inert, how conflicts are expressed and committed from text, and how diagnostics point to authored input or generated metadata. That module is part of the portable source envelope and published grammar, never an invisible desktop cache. An alternative is a fully authored management syntax, but it must win the same task without manually rebuilding snapshots. Existing missing-UUID stabilization is a useful precedent, not proof that instance normalization already exists.

Acceptance: a human-readable tutorial performs initial publication/import/two instantiations/local edit/selective update/detach entirely through text plus the published Rust tooling. Reopen from only the directory and packages. Compare the full model and exact accepted metadata to independently constructed expectations. Measure relevant text edits and incidental identity/bookkeeping edits separately. A smaller displayed snippet must not hide mandatory work.

R2 — P1: cosmetic package changes can make selective updates unusable across unchanged definitions

Locations: L common contract lines 51–56, layered mounts line 72, two-project example 253–260; A unit rules 227–241 and library boundary 293–300. Existing layered compatibility: crates/oa-core/src/data.rs:129–145 checks local identity ancestry.

L hashes exact comments/line endings and assigns new revision identity to changed bytes. A makes that whole pinned revision part of quantity-kind equality and rejects named-kind-to-named-kind AsKind. This is a deliberate conservative policy, but its interaction with selective instance updates is not closed by the worked example.

Minimal falsifier: package P contains Duration, second and two-duration calculation plus a monitor pattern. Alpha has two P@D1 instances and a total budget over both. Publish D2 changing only a pattern description or a source comment; all Duration/unit definitions and stable member IDs are identical. Update only Alpha's left instance as required by L2. If its imported references advance, left Duration@D2 and right Duration@D1 cannot be added. The supported unit conversion requires equal kind and AsKind refuses this named-to-named conversion. If references stay on D1 instead, the proposal needs a defined mixed-version materialization/base policy and must not claim the instance now derives wholly from D2.

The analogous mount problem is concrete: a new mount receives new local IDs. An unchanged item/interface in D2 is not in D1's local ancestry, so existing item/interface satisfaction does not consider it compatible. Rebinding only the chosen pattern can require edits to unchanged outside ports, allocations and message paths. An explicit rejection protects integrity but does not by itself complete a usable selective update.

Choose one policy before ratification:

• Keep exact byte pins for reproducibility and additionally define validated semantic identity/compatibility over a typed definition and its relevant dependency closure. Cosmetic package bytes may differ while the verified definition remains compatible. Do not substitute name matching or a publisher's unverified flag.
• Keep strict revision types and provide a first-class, checked compatibility bridge or selected-use migration that works for genuinely unchanged definitions and shows all affected consumers. Specify bridge scope and composition.
• Deliberately require stable shared vocabulary packages, so pattern-only packages can change while unit/data dependencies stay pinned. This is the smallest initial experiment, but it imposes a package-authoring constraint and does not solve updates to the vocabulary itself. Revise the bundled-definition example accordingly and retain the wider gate.

Do not silently choose structural equivalence for all equal-dimensional kinds: Energy/Torque still require their intended distinction. The needed distinction is between archive reproducibility, definition identity, and permitted use-site compatibility.

R3 — P1: a valid subjectless analysis case falls out of the proposed pattern closure

Locations: A meanings 59–63, root placement 132 and integration 305–307; L publication closure 84–87. Existing transition closure: crates/oa-core/src/transitions.rs:504–571; existing kind mapping :203–235.

A deliberately makes property/case records layer roots, gives a property an outgoing subject reference, and allows a case's explanatory subject to be absent. L says to include new analysis records whose subject is included. Those rules do not find a subjectless case that binds the included properties. Checks have a case parent and no subject. Following ordinary ownership or outgoing references from the activity cannot recover this inverse relationship.

Minimal falsifier: Activity A has property p. Subjectless case C binds p to 750 ms and owns check K. Publish A as a reusable pattern with its analysis. The stated closure can include p because its subject is A, but neither C nor K qualifies by subject. The resulting instance has the property declaration and loses its value/check. Conversely, blindly including every case that mentions p can pull an unrelated project-wide case, its other properties and their architectural subjects into this small pattern.

The same topology matters to OA→SA: selecting A with Subtree currently follows children and outgoing references. New kind mappings alone do not make root-associated p/C/K travel with A. A acknowledges that transition rules need work; this example identifies the decision those rules must make.

Smallest convergence: specify analysis selection as its own reviewed export/transition facet: explicitly selected whole cases, their checks, the properties they use, and declared external property/subject bindings. Show omitted analysis on the selected subject instead of silently treating its absence as complete. Do not automatically slice a case's formula graph or copy all mentioning cases. Decide how reusable patterns store shared formulas versus per-instance assumptions. Add a prototype-local neutral-definition reference rule: a pattern's Local(Duration) must become the intended pinned imported reference or explicitly copied local definition; it cannot be sent through the ordinary local architectural ID remapper without a category decision.

Acceptance: use one subjectless local case and one project-wide case sharing p; publish/instantiate and forward/reverse-transition the small subject with explicit choices. Assert retained/omitted values, checks, external bindings, neutral pins and untouched outside analysis. No graph traversal may choose the scope by accident.

R4 — P2: complete independent cases duplicate the very formulas and fixed inputs engineers need to maintain once

Locations: A candidate ranking 34–41, examples 164–198 and comparison 203. The report already makes D conditional; the current evidence does not justify promoting it over B.

Minimal falsifier: two cases use the same inputs/formula/check except one duration. The provided example repeats the unchanged dispatch value, total expression and predicate. Change the requirement threshold once. Unless the engineer locates every separate check, the two cases now test different requirements while both can still reference the same descriptive Constraint. Factoring a calculation helps the formula but still adds parameters/calls/bindings and does not automatically share the check's threshold.

At a larger, explicit scale, take 20 fixed inputs and 2 varying inputs in each of 20 cases. D needs 440 input assignments before repeated results/checks; baseline plus overrides needs 22 baseline assignments and 38 changed input assignments for 19 alternatives. These are representation counts, not measured human task times. Some independent studies truly need frozen separate assumptions; ordinary engineering properties do not all need that semantics.

Alternative worth prototyping: a property contains its baseline value or derived formula; each optional case explicitly names that baseline and stores only deviations, with a single inheritance level. Evaluation reports each input's origin and the captured baseline/case revision. Distinguish “clear override/use baseline” from explicit unbound. No dependence on active UI selection and no unnamed hidden default case. If frozen assumptions are needed, make snapshotting a deliberate operation. This introduces resolution rules but removes routine duplicate authoring; compare the costs, rather than treating record-count simplicity inside the evaluator as user simplicity.

Decision test: first single property, two-input budget, 20-case single-threshold change, and intentionally frozen study. Measure source lines/edits, wrong-context changes and native task completion. D can still win if its complete-case isolation proves materially clearer, but the comparison must include maintenance rather than only first creation.

R5 — P1: crossing OA/SA with mounted data needs an explicit origin and update disposition

Locations: L layered-definition policy 69–76, pattern layer policy 70 and acceptance L9; A transition rule 307. Existing transition mapping includes DataType/DataField/Interface/ExchangeItem (transitions.rs:213–233) and follows the required contracts (:522–539,568–571).

Minimal falsifier: an OA activity exchanges a mounted library item. Transition the activity/exchange to SA. Same-layer validation requires a compatible SA item. L forbids treating the OA mount as an SA mount, and a package need not provide a matching SA export. Current transition behavior can copy the shared data body into ordinary local SA records; retaining a mount marker would instead violate the immutable mapped payload/layer. Neither outcome has a specified library lifecycle in the proposal.

Smallest convergence: offer an explicit choice in the transition plan: bind a compatible exact-pinned SA export, or create a local SA derivative with preserved origin/trace and clearly defined independence from library updates. If neither is valid, return a located unresolved decision. Do not silently fork, silently retain an invalid mount, or require the engineer to abandon the whole normal transition workflow. The reverse transition and later source-library update must follow the same policy. An ordinary OA/SA semantic trace may record correspondence, but it cannot pretend that package update management was preserved.

This does not require globally neutralizing existing data semantics. It is the concrete test that should decide whether the hybrid mount adapter is simpler than uniform qualified data definitions for this product.

R6 — P2: anonymous derived dimensions need a closed intermediate operator algebra

Locations: A ScalarType 75–80, Expr 118–129, numeric rules 223, unit table 229–241 and public value 271.

Minimal falsifier: evaluate AsKind(Energy, f1 * length1 + f2 * length2). Each product is specified to become an anonymous dimension. Addition is specified for equal resolved kinds; anonymous values have no such kind. The sketch contains no intermediate type, so accepting, rejecting or requiring two inner AsKind operations is currently an implementation choice. Similarly examine (mass * length) / time, comparison of two anonymous products, and anonymous dimensionless intermediates.

Smallest convergence: define a separate closed internal type algebra including anonymous dimensions, then specify every permitted unary/binary/conditional/Sum combination and when the result retains or loses a named kind. It is reasonable to require explicit kind assertion at a declared output; it is unnecessary to force extra casts solely because the internal type sketch is incomplete. A worked force/energy expression should compile to an unambiguous typed tree before GUI/schema work. The conservative affine point/difference table itself does not supply a counterexample and can be retained.

R7 — corrected during review: source numeric limits must admit every accepted exact literal AST

Locations: A exact-number contract 217–221. Existing round-trip obligation: docs/language.rst:1772–1781; the server explicitly compares the formatted/recompiled model (store.rs:116–122).

Initial proposal allows a 4,096-bit canonical wire numerator/denominator, but source numeric tokens have at most 256 decimal digits and exponents at most 128. Expr::Number(10^300/1) is within 4,096 bits, yet its integer spelling has 301 digits and its compact decimal exponent exceeds 128. Rewriting it as arithmetic changes the AST; full model parity is not merely numerical equality. A read-only .NET BigInteger calculation confirmed the 301-digit spelling; no evaluator was run.

The analysis author acknowledged and corrected this in the frozen section 4.2, now lines 238–244: up to 1,234 decimal component digits, actual 4,096-bit admission bounds, canonical integer/ratio output, and explicit literal AST/source/JSON closure. I read back that correction. The added 1/2^4095 example also avoids demanding an excessively long terminating decimal spelling. This closes the identified proposal contradiction; runtime conformance remains untested. Boundary tests must construct an accepted literal via JSON and round-trip the exact AST through source; testing only arithmetic results misses the problem.

Choices that can converge now

Product criterion	Candidate comparison	Recommended next decision
Small-model text and graphical authoring	Baseline properties avoid a compulsory separate case/binding for each first value; complete cases make assumptions explicit but add authored records.	Prototype B and D against the same maintenance tasks. Do not ratify D from evaluator simplicity alone.
Maintained reuse with ordinary local editing	Materialized patterns preserve the current authored graph; virtual instances introduce another effective-model/override system.	Keep materialized patterns and exact typed three-way comparison.
Offline reproducibility	Exact pins, supplied package bytes and immutable revision imports are consistent across both designs.	Keep them; separate type compatibility from archive identity under R2.
Source-only engineering	Full-state serialization is necessary but does not define initial authoring or update resolution.	Require concise authored requests plus explicit normalized management state, or demonstrate an equally usable complete alternative.
OA/SA fidelity	Hybrid mounts preserve current layer checks; uniform references may simplify shared definition identity.	Decide using the mounted-item transition and selective-update falsifiers, not the number of touched Rust files.
Numeric correctness and breadth	Q1 gives a precise rational foundation; approximate engineering functions remain openly unresolved.	A bounded exact experiment is reasonable. It cannot stand in for the declared broader release capability; freeze operator closure and source/JSON limits first.

No new factual standards claim was needed for these findings. They follow from the proposals, revised user requirements and inspected repository code. Primary standards cited by the authors can inform the later capability boundary but do not resolve Studio's identity or source-authoring choices automatically.

Deliberately not reported as defects

The exact stored old baseline, immutable original map plus explicit current lineage, typed foreign/live/historical reference categories, no UUID-shaped string rewriting, complete source/package admission, stale-preview rejection, explicit order conflicts and no hidden deletion cascade are coherent requirements. The prototypes must prove them; merely noting that current code does not yet implement new proposals would not be an independent finding. Existing vacant/Project identity checks and deletion visitors do require the already-planned reservation/category changes, but that is acknowledged integration work.

The affine point/difference separation, exact rational budget, distinct false/missing/failed outcomes and evaluation purity are compatible as specified. Unsupported trigonometry is openly a scope/acceptance decision rather than a secret arithmetic defect. A future approximate domain needs a justified profile; this review does not prescribe a full solver or all of SysML.

Focused experiment handoff

Before broad production changes, build one disposable pure model/source experiment that can be driven without Iced: two properties and a budget; a subjectless case; one package containing units, an item/interface graph and a pattern; two consumers and two instances. Exercise R1–R3/R5 together: authored creation, cosmetic package revision, selected update with an outside budget/contract, explicit analysis selection, and OA/SA transition. Add the exact literal and anonymous-dimension expressions from R6/R7. Independently construct expected accepted graphs and rejected decisions.

The useful output is a contract choice supported by the complete small workflow, including the final authored text and normalized metadata. Passing a resolver-only prototype or showing a shorter source excerpt would not answer these questions. Root owns ratification, implementation and all remaining release gates.