ARCADIA-Studio/harness/experiments/analysis-text-producer-20260925/TEST-REVIEW.md

Independent text-producer test review

Disposition: no concrete precompile test/oracle blocker found. Reviewed six test functions in crates/oa-core/src/language/analysis_source/mixed/carried/text_producer.rs after parent targeted formatting, SHA-256 7b484b7356c48944ce3d1b1fc0e057b79bcfc643a2387978288de4305b381f20. Implementation preformat handoff hash was bbf1aad2f2b9e68804a5e95864620ac2ab78059221b11b7390ef4244e681d0d6; the reviewed identity is the former. No Cargo/parser/test executable was run and no source/test edits were made by this reviewer. Production-source correctness remains separately assigned.

Compared actual tests with accepted text-producer contract and TEXT-PRODUCER-ORACLE.md. The producer fixtures are literal source strings; expected counts/model fields are not obtained by emitting or parsing a desired output. Six functions are selected through their text_producer module path.

Real cap and inventory cases

• Empty E146/145 and escaped project491/490 use the same real owner, inherited entry/byte caps and parser/resolve path. Positives compare complete literal Project and final C+T; prior syntax work remains unchanged after resolve. The explicit phase-only112 control preserves the earlier route and proves it does not accidentally enable producer accounting.
• Multi-file358/357 has actual C253, finalT45 and expected source205/rawtokens31/entries3. It checks final Slots(25,0,298), complete literal Project and part.arcadia error location. The separate lexer-only replay initializes arithmetic C253/T33 and reaches scanner refusal without grammar; its comment correctly disclaims real-owner provenance. It therefore supplements rather than mislabels the complete-source fixture's error location as unique scanner proof.
• Projection304/303 correctly uses the40-character description fixture: finalT83, earlier UUID46 and preprojection72. The cap-minus-one failure targets the final projected key, not an earlier identity. Independent accounting wrapper confirms retained text304 at success. This test does not claim complete model admission at that cap.
• Compound453/452 checks finalT49/C383 and the parameter UUID peak70. It covers ordinary optional IDs, typed declaration/parameter identities and historical UUID consumption, nested-key copy/refund, ordinary reference projection and typed reference moves. It explicitly labels arbitrary activity payload syntax-only and never unwraps a full Project for it. The inventory wrapper traverses actual syntax without executing model construction, so this scope is appropriate.

The helper project::text_producer_inventory seeds the actual guard C and calls the real bounded accounting walk. It does not synthesize expected syntax or Project. Literal totals49/83 remain the independent oracle; equality between production counters alone is not their only assertion.

Scanner, compatibility and arithmetic

Raw JSON examples cover empty/ASCII/raw UTF-8, escaped backslash, LF, BMP escape, supplementary surrogate pair, invalid escape and lone surrogates. The scanner observer records Reserve then Released for successful tokens; closed-invalid cases preserve legacy Error classification and a deliberately refused reserve prevents a later release event. Unclosed input has no decoder hook. Arithmetic quoted tests cover P/P-minus-one with explicitly labeled synthetic baseline100, verify decoded D, drop the result then refund, and require no installed text on refused reservation.

The actual malformed source with120 raw payload bytes and119 extra headroom distinguishes stronger-mode storage refusal from phase-only/legacy invalid-token errors. Complete OA/SA zero-carried tests compare actual Project, warnings, Usage/numeric work and retained Slots with the prior route, and independently reconcile producer text. They use accepted short property words. They are equivalence controls, while E/escaped/multi provide literal whole-Project oracles.

Duplicate-description fixtures admit the first100-byte description at independently counted108/110 overlap, then require the existing duplicate error before a second grammar decode could consume another100. Scanner validation can independently admit100 before grammar starts; no earlier scan cap preempts these assertions. Arithmetic overflow/refund panic tests are clearly separate from real owner provenance.

One limit: scanner callback event order alone does not prove the library decoder's internal allocation timing. The corresponding production source must place Reserve before the existing serde call and Released after the result drops; I checked the relevant narrow raw scanner excerpt and it follows that ordering. No claim of internal serde scratch/capacity metering follows.

Historical oracle correction

The earlier PRODUCER-CRITIQUE originally gave empty E UUID33..71 and transported33..34. Literal counting confirms 34..72, transported 34..35. The test's34 is correct. This was an independent pre-execution source-offset typo; no runtime failure or implementation change prompted it. Counts/caps are unchanged. An annotated correction was made in that critique and appended to TEXT-PRODUCER-ORACLE.md; escaped quote start200 and the other pinned fixture locations remain unchanged.

Final independent readback rechecked the actual unchanged test source at SHA256 7b484b7356c48944ce3d1b1fc0e057b79bcfc643a2387978288de4305b381f20. Its literal empty E bytes hash to 48fe360b7b5f57867086e7f6fa47c2913765c1261e558e7ebec688a1f842a65e (78 bytes). Byte33 is a space; opening/closing quotes are bytes34/71, so34..72 and the existing test's34..35 diagnostic are correct. The source diagnostic function consumes the single UTF-8 character at the transported start. This confirms the documented erratum without code changes, parser execution or compiler use; the reports are ready for packaging.

Ready for parent gates

Prepared readback checker delta was reviewed separately and remains unrun: updated baseline269 names/253pass16fail, intended text_producer filter and local committed archive pin retain the previous strict source/log/receipt/artifact checks. Its archive is not described as remotely published while server recovery is pending.

Parent compilation, six focused tests, unchanged full-library disposition, listing, strict core all-target Clippy, format comparison and stack controls remain necessary. This source review neither establishes those outcomes nor expands the prerequisite to accepted output, universal parser-before-growth accounting or arbitrary stack guarantees.