Carried-phase independent test review

Disposition: ready for parent compilation and runtime gates, with no remaining source-level blocker found. This is a read-only test/oracle review, not test execution or acceptance of compiler results.

Reviewed crates/oa-core/src/language/analysis_source/mixed/carried/tests.rs in .local/as3batch, final SHA-256 26730fd70ec13e0a211a3650e041323bbaf8ba3eb30382273165e9b4b378bc6b, containing12 tests. Compared with the independent CARRIED-PHASE-ORACLE.md, accepted harness/analysis-carried-phase-contract-20260925.md, existing parser/projection/accounting implementation, and new carried authority shape. No Cargo, source edits, commits or remote writes were performed.

Findings resolved before compilation

The initial frozen test hash bbee6aab87f99a98ecc3fdab30cea4b998f405d8e07b36e23e7a9cdb52f9e099 had two concrete fixture/assertion defects:

The OA/SA parity fixture used oa_engineering_property and sa_engineering_property. The mixed parser explicitly rejects these long names before intended resolution/index parity. Implementer replaced them with accepted oa_property and sa_property.
The include-policy test assigned full include span0..23 to both depth and edge refusals. Edge cap1 first fails inside mixed::State::include, whose ordinary error transport produces span0..1; depth refusal arises from traversal and retains0..23. Implementer separated the expected spans.

Both corrections were reread in the final hash above. They alter test inputs/expectations, not production policy.

Oracle agreement and phase reachability

The literal empty and three-file fixtures agree with independently authored counts: owned C (1,0,102) and (3,0,180); final U/M 1/11 and 3/19; scanner work (78bytes,19tokens) and (132bytes,31tokens); syntax entry caps13/25; complete resolver entry peaks17/29 and text peaks112/214. Final retained Slots (13,0,110) and (25,0,212) prove C participates exactly once. Assertions cover complete literal empty Project, empty warnings, exact work counters, canonical file order, actual bundle pointer, retained owner guard and unchanged owner contents after witness destruction.

Cap-minus-one syntax tests name the actual failing file, including part.arcadia for the cumulative three-file case. Entry/text resolver negatives first unwrap successful parsing and assert catalog header span11..73. The identical zero-baseline profile resolves successfully, providing the needed discriminating positive control. Exact-cap full success is supplied by the first test, not inferred from failure arithmetic.

Legacy cap11 returns syntax and later fails resolver sum12 at span0..0. Explicit carried borrowed-zero cap11 refuses preprojection at span0..1; cap12 clears syntax. This catches both a numeric-zero bypass and accidentally changing original parser timing. Initial C+file-slot tests include the deliberate max_files0 ordering sentinel, accurately described as a test-only inadmissible target rather than successful predecessor provenance.

Text refusals occur after parse succeeds and quoted names are demonstrably decoded. Empty bytes109 names the header; chain bytes211 names part's include0..23 because accounting uses canonical file order. The source-size and raw-token tests use borrowed-zero mode so owned C.text cannot preempt the intended work boundary. Their seed empty bundle fits each inherited profile. Traversal limits have an exact positive triple3files/2depth/2edges and separate failing coordinates.

Added ordinary-position text oracle

The one ordinary activity with description "é"; has retained syntax text45 bytes: project alias/name8, ordinary alias/name2, field-span map key11, AST field-map key11, decoded string2, projected Record key11. The projected scalar is EditKind::Atom, so no second literal String is counted there. At C.text+44, prior text34 fits and the final11-byte projected key exceeds the ceiling. Projection's EditField.span starts at the description keyword and ends after its semicolon, matching the test's exact expected diagnostic.

This test proves that particular postparse refusal and copied-key contribution. It does not assert that C+45 admits complete resolution; catalog and potentially mapped diagnostics are later phases. It therefore makes no unsupported exact complete-resolver-cap claim for this fixture.

Policy, ownership and limits

Exact snapshots compare all6 Limits fields and all7 scalar ProjectLimits/model fields. Behavioral controls exercise references0, frames0 and numeric72 refusal, then roomy successful resolution for the same typed forms. The independently specified literal1 meter cost73 is also used for a prior nonzero numeric-work witness and a fresh73-unit reparse, detecting accidental accumulation of prior work. Model caps reach typed-record admission or real reference work; seeds remain admissible under each tightened policy.

No test invokes a production arbitrary-Slots constructor. Retained owner fixture construction derives C from its actual map/source/path/entry bytes; borrowed construction captures a witness's policy without borrowing that witness's lifetime. Dropping the seed before parsing is consistent with the intended copied immutable policy. Nonzero occurrences and usize overflow are explicitly marked fault injection; they are not represented as real successful owner provenance. Sibling test access through the cfg(test) phase_state method appears consistent with its parent-module visibility; compilation remains the authoritative check.

OA/SA zero-carried parity now reaches the accepted short-word grammar and compares Project, warnings, storage, Usage/numeric work, both index name/occurrence families and original bundle ownership under Unicode/CRLF input. It is equivalence coverage, not a separate authored whole-model oracle; the empty/chain success tests provide their own literal complete Project.

The tests and this review do not establish universal before-allocation admission, a stack guarantee, production emitter provenance or editing/install authority. Parent owns actual focused/full/list/Clippy/format evidence and inherited failure reconciliation.

Final slim-guard delta

Reviewed committed delta d11b99bb4ab1c817951557551db3a3c7cbd5c425..fa7a980418ef99d772e67c66c28dfa7b5181f875. Final tests SHA-256 794c8e987b43d4a652361bf7e31eff314f917955824efdbb1ba74b0216c4018a. The only test changes select GuardBacking::Retained instead of SnapshotBacking::Retained for the same actual-owner pointer assertion, and obtain the consumed input's guard through into_parts().2 for the same direct overflow checks. No fixture, numeric expectation, cap, diagnostic, case or assertion was removed or weakened. The policy moves into syntax/Budget while the smaller retained guard keeps the owner borrow. Runtime disposition and the preserved initial stack abort are recorded separately in RUNTIME-REVIEW.md.

6.8 KiB Raw Blame History