ARCADIA-Studio/harness/experiments/analysis-ordinary-index-20260924/ORDINARY-RUNTIME-REVIEW.md

Independent ordinary-index runtime review

2026-09-24. No blocking finding for the accepted private authored-name indexing dependency. Final source is ee500908e3d77182ddd54e12524f9b6c6eb43b60, private branch codex/analysis-ordinary-index-956atf-20260924, compared with typed-index baseline 93eb6117f95353d25d594d59780018f197c51672. This review reconciles existing runtime evidence, source and independently authored byte oracles. It does not rerun Cargo or invoke a test executable. No production edits, commits or peer posts were made.

The scope remains the accepted harness/analysis-ordinary-index-contract-20260924.md: consumed, private, read-only complete ordinary authored-name occurrences alongside the retained typed owner. This is not rename composition, arbitrary edit coverage, public source8 activation, GUI parity or a green full suite.

Frozen source and reproducible readback

Production is byte-identical to the earlier source review and the initial test attempt at 147b247398cdae4b0fbbf977e301fffcaa450108:

File under crates/oa-core/src/language/analysis_source/	SHA256
mixed/project/ordinary_index.rs	f516574abd74ea92632b63684afa6ab38edb8485b43ed1ca80b2a91c01dff4a4
mixed/project.rs	3f6aded6bff521d7991c491ded3001698874fc1a667951e91941669afa2aadd6

The source checkout is tracked-clean at the stated final HEAD. The repair diff changes only ordinary_index/tests.rs, its category fixture and an implementation-note document. The production review's ownership, original-token projection, containment, complete global namespace, scratch lifecycle, error fallback and legacy-separation conclusions therefore remain applicable.

Independent report-only checker: inspect_ordinary_runtime.py, SHA256 241abca33737692d6cf7a468c06c2ef5bf731110c488df39348b302149eb7ded. Result: ORDINARY-RUNTIME-READBACK.json, SHA256 2a9d234a22299dd97698c8f555fc8a1d3cc2b9a5d1f426ba8df7b02e54cfe03d. Run from repository root:

& 'C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe' -B .local/analysis-mixed-index-seam-20260924/inspect_ordinary_runtime.py

This script reads Git objects, raw files and receipts, hashes the current executable without running it, and writes only its report JSON. It was inspected before use and exits zero. Its first draft had an overly greedy multiline failure-header regex; that inspection-script bug was corrected to a newline-bounded header before the successful comparison. No raw evidence was altered.

Runtime evidence and baseline comparison

Raw evidence is in .local/analysis-ordinary-index-gates-20260924/ordinary-{focused,list,full,clippy,fmt}-ee50090-1.*; baseline is .local/analysis-mixed-index-gates-20260924/index-{list,full,fmt}-93eb611-1.*.

Gate	Actual result	Independent reconciliation
Focused ordinary tests	13 passed, 0 failed; exit 0	Exact 13 new names, no duplicates/missing/ignored cases; summary agrees with raw outcome lines.
Library listing	229 names; exit 0	Exactly baseline 216 names plus those 13 names; equals final full-run membership.
Full library	213 passed, 16 failed; exit 101	Every old outcome unchanged: baseline 200 pass/16 fail, plus 13 passing additions.
Strict all-target clippy	exit 0	Actual command includes --locked --offline -p oa-core --all-targets -- -D warnings; raw log ends with successful completion.
Workspace formatting	exit 1	Entire raw log byte-identical to baseline; SHA256 c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d.

All 16 complete failure blocks match the baseline after normalizing only the numeric thread identifier on the panic line and reading standard line endings. No diagnostic text, source location, test name, assertion body or backtrace note was removed. They remain the six language::nesting_tests and ten source_files::transaction_tests failures rejecting schema8 through the existing public reader (Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.). This comparison establishes unchanged observed failures, not correctness of those still-failing workflows. Formatting differences remain confined to the same model.rs, references.rs, semantic/catalog.rs, session.rs and transitions.rs hunks; no new ordinary-index formatting diff appears.

Both initial and final manifests contain 549 files. Every recorded path, byte length and SHA256 matches its exact Git blob and the complete ls-tree set for the launcher's declared input scope. Every final file also matches the current raw working bytes. Final manifest SHA256 is fd3bb5cb81341352f781587b747c6272287e71570491b6e916ce71370a1d89d6; initial manifest is 4ecaa87a87f12fe818a61b29fdf8363b7c0b159da1d759c652f809c841214423. This pins the specified Cargo/build/crates/assets/docs/examples/fixtures/vendor inputs, not every environment or every repository document.

For all eight initial/final receipts, result/log/input/launcher hashes were checked, raw outcome/list lines re-extracted, source/head-after equality confirmed and recorded changed-input/verification-failure arrays checked empty. The recorded launchers were read as code rather than executed. They require clean identified source, capture immutable helper bytes and input bytes before Cargo, preserve raw stdout/stderr, hash emitted executable paths, and record post-run inputs/HEAD. Final launcher SHA256 is 2b88d5006c81dcfb801e45559ae2e7bd948d5897f04ea1d1f34a3d42bcdd5efe. The five final commands and their single-thread test arguments match the intended gates; lifecycle overrides and RUST_MIN_STACK are absent, with CARGO_BUILD_JOBS=1.

The executable named by the focused/full/list Cargo Running lines and their receipts is currently present at .local/analysis-checked-save-target-20260913/debug/deps/oa_core-416e35542925bed6.exe: 41,463,296 bytes, SHA256 208e0e790627d7ab20d1fdf4a83b65ccc452b003510c8f6ae3bfb96fe57b9110. All three receipts match these independently read bytes. Initial executable receipts are historical; the current file is the final rebuilt artifact and is not misrepresented as the earlier executable.

Original oracle and precise fixture supersession

The original ORDINARY-ORACLE.md remains preserved as pre-runtime evidence. Its initial category literal hash a220ae836c38e7f1568749edc50891c43f7f34a4152e7224a125ae05618c8e05 and the example parent @ /* @noise child */ a; are superseded for runnable-fixture/admission claims. The language does not support that block-comment spelling. Final category SHA256 is 3943579866157c7b5d95ce9edcb2d643058826b9af44257557e2864f130d15fc. Both files are exactly 2,152 UTF-8 bytes; their sole replacement is the 22-byte reference extent 323..345, from @ /* @noise child */ a to @ // @noise child\r\n a. Alias a remains exactly 344..345.

All 36 complete original numeric tuples, including file, owner, target, role, full extent and alias endpoints, remain valid unchanged. The independent checker compares all 36 original report rows to the final Rust literal tuple array and verifies every alias against the corrected raw UTF-8 source. Thus the repair changes valid trivia spelling without deriving expectations from implementation output. N remains15 headers+21 references=36; G15,T0; no new reference is introduced by the comment. Historical UUID, prose, implicit parent and include exclusions remain intentional.

The final rich-map test (tests.rs:39–145) preserves the original independently specified OA/SA maps and their Unicode/CRLF offsets, complete rich_model(layer) equality, canonical files, bundle identity, both retained typed maps, complete names/warnings/static metadata, parsed Usage and numeric units. Its retained ordinary increment is exactly6 OA/7 SA. The cross-file test (:148–170) includes the independently suggested reference (1,82,84) from owner3 to global2, extent81..84, while keeping coincident header coordinates in distinct canonical files and excluding display-name prose. The category test (:554–647) compares the complete36-row map, retained Project/warnings, ordinary-only empty typed maps, exact36-entry increment and unchanged Usage/numeric work. Category full-Project equality checks preservation of the incoming admitted model; the rich fixture supplies the independently constructed complete model oracle.

The initial focused log is retained: 9 passed/4 failed at 147b247. It correctly exposed three admission failures from unsupported block comments (category semantics, expanded category scratch and UTF-8 corruption), plus a duplicate-header test stopped at earlier physical uniqueness. These were test/fixture failures, not discarded passing evidence.

The final changes reach the intended checks:

• tests.rs:447–495 removes the old physical CallTarget at file2 span291..292 before inserting a second typed Declaration token for the same global. It leaves the original declaration header intact. ordinary_index.rs:103–119 can now finish unique physical insertion and reach b.header; the exact expected Global declaration header appears more than once. diagnostic passes. The separate ordinary/typed physical-collision tests remain present and pass.
• tests.rs:531–543 uses valid diagram @ // 雨\r\n d, obtains an accepted indexed owner, then changes only the retained Reference start to the interior UTF-8 byte of 雨. It reaches original-file UTF-8 validation and asserts Ordinary span is outside its original UTF-8 file., canonical main.arcadia, and default safe span without panic. It does not count an earlier parse error as a successful corruption test.
• The corrected category literal reaches the entire ordinary map and expanded-scratch walk; the original exact numeric expectations and exact refusal span are unchanged.

Peak isolation, lifecycle and limits

The original oracle's final cap-fixture refinement remains the applicable accounting specification; earlier proposed rich+3 and unexpanded-category cap pairs are not the runtime acceptance tests.

tests.rs:172–220 uses rich OA plus six leaf activities. Incoming indexed baseline remains live. G13+T21+finalN12 reaches baseline+46. Passing cap46 retains exactly12 extra entries; cap45 fails at the last authored header extra25, with its exact seven-byte span. Both cases establish a single parse-time profile, parse/resolve/typed-index successfully under that same inherited limit, compare the resulting baseline, and only then invoke ordinary indexing. No replacement ledger or relaxed earlier-stage profile hides a premature refusal.

tests.rs:650–694 expands the corrected category with64 valid route points. Independent literal expansion is3,124 bytes. At the peak, retained map11+G15+pending edge/point work66 gives baseline+92; T0. LIFO traversal first handles the diagram view-option reference, then the route; after popping the last point, pushing x then y reaches W66. Cap91 fails before the y Atom push at 1712..1713, checked independently from raw bytes; cap92 succeeds with exactly36 retained entries. Earlier stages again demonstrably succeed under the same profile before ordinary indexing. This covers scratch pre-reservation, successful release and full inherited baseline coexistence rather than assuming a loose final-N+max-W bound.

The remaining exact-message corruptions cover owner/lexical-owner disagreement, relocated alias, project identity, synthetic-root braces, missing marker, shortened/extended reference, spelling/class corruption, parent containment, absent global target/header, duplicate physical ownership, invalid file key and UTF-8 diagnostic fallback. The scoped-name test resolves ordinary @x to the global while preserving the same-spelled calculation parameter. Both128-KiB thread tests pass: normal indexing/drop, late absent-header failure, a127-deep typed expression owner, and32 nested ordinary declarations with unchanged Usage and33 retained headers. These are bounded observed lifecycle cases; they do not establish arbitrary-depth behavior or allocation-failure coverage.

Completeness still relies on the sealed parser projection plus the independent complete-map tests. The checks do not promise detection of arbitrary coordinated omissions from that trusted projection. No new constructor/updater authority or public behavior was introduced during the test repair. Final acceptance and publication remain with the parent; subsequent rename/edit composition needs its own contract and whole-output oracle.