ARCADIA-Studio/harness/experiments/analysis-mixed-index-20260924/RUNTIME-REVIEW.md

Mixed typed-index runtime/oracle audit

2026-09-24. Independent read-only audit of private source 93eb6117f9, .local/as3batch (HEAD and clean working tree verified). No Cargo, compiler, tests, source edits, process interference or Gitea operations were performed by this reviewer. Evidence below audits parent's recorded runs, their source binding and authored test assertions. It does not authorize public source8 or claim whole-library/format success.

Disposition

No blocking discrepancy found between the seven new tests and the independent ORACLE.md, or between the final receipts and raw logs. All 209 inherited named outcomes are unchanged; seven new names pass. Strict core all-target Clippy passes. The full library still fails with 16 inherited public-schema failures, and workspace formatting still fails with the identical inherited eight diff blocks. These remain failures, not waived passes. Parent owns final checkpoint acceptance/publication.

Raw run and receipt audit

Evidence directory: .local/analysis-mixed-index-gates-20260924; all five final runs have source, input-manifest source and head_after exactly equal to 93eb6117, empty changed_inputs and verification_failures, and identical 545-record input inventories.

Receipt stem	Actual scope	Exit / raw result
index-focused-93eb611-1	cargo test --locked --offline -p oa-core --lib language::analysis_source::mixed::project::tests::index_tests:: -- --test-threads=1	0; seven named tests pass
index-list-93eb611-1	cargo test --locked --offline -p oa-core --lib -- --list	0; 216 unique test names
index-full-93eb611-1	cargo test --locked --offline -p oa-core --lib -- --test-threads=1	101; 200 passed, 16 failed, zero ignored/filtered
index-clippy-93eb611-1	cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings	0; raw log completes dev-profile check
index-fmt-93eb611-1	cargo fmt --all -- --check	1; eight inherited formatting blocks across five files

Independently parsed each raw log. Every focused/full (name,status) sequence equals its receipt, and all 216 listing names equal the full-run name set. No duplicate, missing or additional outcome was hidden by map comparison.

Verified SHA-256 of every final raw log, input JSON and captured launcher against its receipt. Final full input manifest's all 545 paths were read as binary Git blobs with git cat-file --batch at the exact commit and checked for byte length and SHA-256; all matched the captured manifest and current disk files. Focused/list/Clippy/fmt inventories equal that full inventory exactly. This validates the declared launcher input set, not an assertion that unlisted environmental dependencies are covered. The focused/list/full executable artifact's current byte size and SHA-256 also match all three receipts. No artifact was executed by this audit.

Raw log SHA-256:

• focused: ddf7862fd7264ed6449c07d653f471428421f244fb0fa537960bb5639ccbcf0c
• list: ff3b75a04657d81cd86d82acf33df77c815b374c50c2bee843577d18e40a1615
• full: 7f4ede0908156a94c10c1d730f1b7bd89c23b6b777d1daef22693019827e97e1
• Clippy: f2b5481093a92be82ad9cd6cd843a863b7530d387d5d6b7483f107e70ba2f650
• fmt: c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d

Exact inherited dispositions

Compared .local/analysis-mixed-project-gates-20260923/project-full-71cadfa-1.result.json and its raw log against current full results. Old raw outcomes equal the old receipt: 209 = 193 ok + 16 FAILED. Every old name is present now with exactly the same status; no old test was removed, renamed or changed from failed to ignored. Exactly these seven new language::analysis_source::mixed::project::tests::index_tests:: suffixes are added, all ok in both focused and full runs:

• copied_name_bytes_coexist_with_retained_warning_bytes
• damage_reaches_structural_token_and_call_checks
• distinct_qualified_keys_cannot_share_one_physical_token
• entire_authored_index_oa_sa_original_and_unicode_crlf
• invalid_file_and_utf8_span_use_explicit_safe_fallback
• new_maps_keep_baseline_and_scope_reservations_and_peak_scratch
• success_and_late_failure_drop_on_small_stack

The same six language::nesting_tests and ten source_files::transaction_tests fail. Compared all 16 raw failure blocks by test name after replacing only the variable thread ID immediately before panicked; all 16 bodies are otherwise identical. Every body contains Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7. These public paths have not acquired source8 support, and failures occurring at schema acceptance do not validate their later reparenting/save/recovery behavior.

The new fmt raw log is identical to .local/analysis-mixed-project-gates-20260923/project-fmt-aaec78f-1.log even before path/line normalization. Same eight blocks in crates/oa-core/src/model.rs, references.rs, semantic/catalog.rs, session.rs, and transitions.rs; no new index file is listed. Both runs exit 1. Also verified old full/fmt log, input and launcher hashes against their respective receipts.

Authored oracle and test review

Source paths here are under crates/oa-core/src/language/analysis_source/.

• mixed/project/tests/index_tests.rs:30–237 implements all authored names and exact key/span maps from ORACLE.md, for OA and SA and both original LF and prefixed Unicode/CRLF source. It compares full Project to independently built rich_model(layer), complete names/maps, original bundle identity/files, warnings, admission metadata and numeric usage. The byte transform at lines 17–26 is independent raw-source arithmetic. All 15 expression paths and 21 occurrence records match the prior authored table; OA/SA names are 11/12, retained deltas 59/60 entry slots and 11/12 owned-name bytes, with unchanged lower occurrence slots. No expected key is generated by walking the actual lowerer parent arena or formatting an actual index.
• Rich fixture/model extraction in mixed/project/tests.rs:253–327 preserves the old independent OA model and global arena test; it only factors their literal/model construction for reuse and adds SA parameterization.
• index_tests.rs:251–335 tests 13 deliberate corruptions with exact expected messages and applicable file ownership. Case 6 changes occurrence 11's target from Q(10,1) to Q(11,1), exactly the equal-spelling/wrong-callee control in ORACLE.md. Its message is the call-site mismatch, not an earlier unknown-name rejection. Case 7 removes that label and reaches the argument-child check. Existing source checks in index.rs:619–667 support these claimed phases. Arbitrary non-expression-reference omission is not falsely promised as runtime rejection.
• index_tests.rs:339–375 uses inherited baseline plus 97/98 entry-slot caps. The 98 peak is independently consistent with the implemented lifetime policy: final maps/paths 59 + owners 3 + physical entries 21 + path lookup 15; these coexist at the last occurrence. Source drops owners/physical at index.rs:615–618, then drops paths/calls at :669–673, so later peaks 77 and 90 are lower. The negative requires the exact entry refusal at original main span329..330; success retains only baseline+59 and original occurrence slots.
• index_tests.rs:378–402 proves a one-byte name copy is added to retained warning/syntax text: original 236, negative cap236, positive cap237. It does not reset the baseline.
• index_tests.rs:405–486 exercises success and late rejection on the 128KiB stack (including depth128), safe diagnostic fallback for invalid file/UTF-8 spans, and physical token uniqueness even when qualified keys differ. This supports the bounded private lifecycle claim, not general GUI or public depth enablement.

The two follow-up test fixes preserve the intended evaluator. 1d02206c changes only matches!(case, 6 | 7 | 8) to equivalent 6..=8. In 93eb6117, the prior complete Usage equality becomes equality with only deepest_frame raised to max(previous,4); all other usage fields and numeric work remain checked unchanged. Four is independently derived from root + Left + Argument(1) + Argument(1), already in ORACLE.md, and accepted contract explicitly permits depth verification to update that peak. No production branch or assertion was removed to make these failures pass. Earlier failing receipts should remain in the package as provenance, not be relabeled successful.

This review covers recorded runtime evidence and oracle fidelity, plus the narrow source paths needed to validate those claims. It is not a replacement for the parent's independent full implementation/authority review or the later ordinary-index/composition/public-source8/parity gates.