ARCADIA-Studio/harness/release-analysis-core-schema8-wip-20260911.md

# Schema8 core source handoff

## Current root execution and review — 2026-09-11

Root completed the corrected required depth128/129 and call32/33 regression
(1/1), the complete `analysis::` filter (28/28:25 analysis plus3 topology),
numeric26/26, and strict core all-target Clippy with `-D warnings` (exit0,3m37s).
The default Windows test stack and required limits were unchanged. Independent
`analysis_core_review` found no material new correctness/resource defect in the
iterative checker/admission correction; [Gitea342](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-342)
records its conclusion. Source hashes match the correction freeze below.

Root's durable `harness/release-analysis-core-iterative-gate-20260911.md` and
`harness/release-analysis-core-iterative-review-20260911.md` record execution and
independent scope. Immutable root `.local/analysis-core-iterative-gate-20260911/`
contains274-input manifest SHA256
`28D6CEAE5C52765F5DB5CB411D7E42EDAB91359C9E351663315BC4B7F1FF2B7A`
and corrected test executable SHA256
`2B4EE8BA63B20415B352E084314CC7504E778C093598B9564C6EA4F56BC921C9`.
Clippy log SHA256:
`6FE529BBA6A761FEDACB1A3933BB86E4FB644D8CC192F57FB0F45EFA5B9ABFFF`.

This supersedes the awaiting-rerun status below, preserving the first actual
failure. It does not close full core integration, bounded codec/lifecycle/output,
source8, evaluator, UI/REST/CLI parity, libraries or release acceptance. The source
remains isolated from root's runnable schema7 application.

## Historical stack-overflow correction source freeze — 2026-09-11

Codex-956atf `/root/analysis_core_resume`, renewed debugging lease after root's actual first Windows gate. The same dedicated worktree/branch remains at HEAD `b96ff3935ab3f36b7144566e46559a05a29292a5` plus uncommitted corrections. **The first candidate failed; this replacement is frozen source awaiting root's rerun.** No compiler was run by the worker.

Root's original `cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1` compiled warning-free in3m34s, discovered28 tests, logged16 named passes, then aborted at `analysis::tests::logical_depth_and_call_depth_have_exact_boundaries` with Windows `STATUS_STACK_OVERFLOW` / `0xc00000fd`. Preserve the original root `.local/logs/analysis-core-first-20260911.log` (SHA256 `84C6B63039472363412B66C7A24DE825A846518725EC9F7436C252603AEF54FC`) and root-reported binary `target/debug/deps/oa_core-a7a95d666500007c.exe` (SHA256 `548850D3606C9B4A58859677E86A1C1813EB6E71785C529F771E04125E7A33AF`). Gitea issue1 comment305 records the actual failure. Neither compile success nor the16 earlier passes establish a full gate pass.

The test-count discrepancy is resolved: Rust's substring filter `analysis::` selects25 schema8 tests **plus three existing `topology_context::analysis::tests`**, declared through `topology_context/analysis.rs` into `analysis_tests.rs`. The earlier prepared25 was the schema8-module count, not the full filter count; the saved22 would likewise have selected25 with those topology tests. The current corrected filter still expects28, with no ignored/removed or additional test functions.

The large recursive `Checker::expression` was the concrete source-level suspect; no profiler/frame-size measurement established the exact abort instruction. It is now an explicit continuation machine with at most128 heap frames and one returned type. Each frame borrows its Expr and any calculation definition and owns only fixed-size resolved types/handles. Lists and calls schedule one ordered child at a time. The rejected129th frame is never allocated, while its entry event is still charged to preserve failure precedence. Rust call depth no longer scales with Expr depth, and typechecker-frame destruction does not destroy the borrowed Expr tree.

The continuation states retain left-before-right operands, condition-before-both-branches, Sum initial-before-values, AsKind target resolution-before-operand, declaration-order call arguments, contextual empty-list typing, branch type equality and existing node/key/argument meter precharges. No numeric operator semantics, fixed KindHandle, lowerable1,000,000-event ceiling, accepted128-depth bound or stored schema was changed. No stack-size override, release-only workaround or ignored test was introduced.

The original failing test now includes diagnostic phase markers and unary128/129, mixed Binary/If/Call/Power/Unary128/129, contextual empty-list If/Call128 and definition-call32/33 boundaries. The existing parameter-purity test now makes call declaration order versus UUID order and binary left-to-right error precedence observable through distinct invalid-reference errors. The already compiled meter tests retain their exact event expectations.

| Path | SHA256 at correction freeze |
|---|---|
| `crates/oa-core/src/analysis/typecheck.rs` | `831F14346BBAE83FBDEEB744F9F29460FAB13A8315645FAA6CE94D0B60B1516F` |
| `crates/oa-core/src/analysis/tests.rs` | `9FB30B28E305CB00E7C39204912F8311E96AA92D0334CE4A73FB08FADDFE83C5` |
| `crates/oa-core/src/analysis/admission.rs` (unchanged since first candidate) | `5F85EAA868AC43C4819C98556281D8226F9C0E2A4B11E5C97CF24D855D2127AE` |

Standalone installed rustfmt2024 check and `git diff --check` pass for the correction. Root's next commands from this worktree, using its established toolchain/cache:

1. `cargo test --locked -p oa-core --lib analysis::tests::logical_depth_and_call_depth_have_exact_boundaries -- --exact --test-threads=1 --nocapture`
2. `cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1` (28 expected).
3. `cargo test --locked -p oa-core --lib analysis_numeric::tests -- --test-threads=1` (26 expected).
4. `cargo clippy --locked -p oa-core --all-targets -- -D warnings`.

Admission's structural Expr/reference walks and dependency/case graphs are already iterative. Inspected architectural index construction borrows analysis records and clones only ordinary step-ID vectors; its analysis-reference branch avoids cloning Expr-bearing elements. This identifies no further recursive Expr traversal in the immediate admission path, but is not execution or stack/RSS evidence. Derived Expr Clone/Debug/equality/Serialize/Deserialize/Drop, partial decode teardown, command cloning, output expansion and full codec/lifecycle/source parity remain the separately documented production risks. Default Serde recursion rejection remains unchanged. Root owns execution, follow-up findings, integration and release publication; there is no complete schema8 transport or release claim.

## Historical first resumed source freeze — 2026-09-11

Codex-956atf `/root/analysis_core_resume`, resumed by root after the user returned. **Source frozen for root's first compilation gate; still uncompiled staging.** The dedicated worktree remains `C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-core-worktree-20260911`, branch `codex/analysis-core-20260911`, HEAD `b96ff3935ab3f36b7144566e46559a05a29292a5`. No commit was made by this worker. The reboot record below is retained as historical evidence; this section supersedes its stopped/pending-static-review status only.

The resumed delta changes three Rust files plus this report:

| Path | SHA256 at resumed freeze |
|---|---|
| `crates/oa-core/src/analysis/admission.rs` | `5F85EAA868AC43C4819C98556281D8226F9C0E2A4B11E5C97CF24D855D2127AE` |
| `crates/oa-core/src/analysis/typecheck.rs` | `1AC3A92E97B886F4BFAC31BA22C182347131D0A82BEDBF6B2F2073D02AD5A6E4` |
| `crates/oa-core/src/analysis/tests.rs` | `9EC9C12C618600039BC2DC0A9B9BF6DC5378FD4D8749E21EDEC699EEE06AB0E2` |

- `admission.rs` precharges expression child slots before queue growth, rejects visited-plus-pending closure overflow before allocation, meters initial closure queue entries, text spans and scoped parameter names, and charges each relation-subject traversal hop. Known indexed element layers use direct map lookup. This closes analysis-specific unmetered work; it does not bound the existing architectural validator, wire decoding or recursive lifecycle operations.
- `typecheck.rs` groups owner/field/layer/parameters in `BindingContext`, removing the eight-argument helper. Call arity remains an O(1) check; the complete scoped-key scan is precharged before lookups, then declaration-order argument lookup/type work is separately charged. Actual parameter identity and all-branch checking are preserved.
- Three new meter tests exercise 1,024-wide List/Call precharge, a 64-parameter malformed/valid Call at exact work boundaries, and 64 relation hops with terminal element/missing/cyclic endpoints. The existing real-Project aggregate-limit test also checks text-byte accounting and exhaustion before invalid text inspection. These relation-chain fixtures deliberately test malformed input before architectural admission, not newly accepted architectural relations.

**Expected focused count is now25: the saved22 plus three new meter tests (21 actual-Project tests and four meter tests total).** Command from this worktree: `cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1`. Root owns the toolchain/cache configuration and all execution. Follow with the changed numeric-helper regression filter `analysis_numeric::tests`, then strict core Clippy; the earlier26 numeric passes apply to7d14bd0, not this schema8 candidate.

Read-only review covered existing persistent-enum/Project constructors, command/reference call sites and the analysis lifetime/borrow paths. Standalone installed `rustfmt --edition 2024 --check` passes for all three changed Rust files; `git diff --check` is clean. **No Cargo/rustc, test, Clippy, native, Linux or memory/stack measurement was run by this worker.** No root-checkout files, manifests, lockfiles, ledgers, fixed KindHandle, numeric semantics or other worktree-owned source changed during resume.

The lowerable aggregate1,000,000 static-event ceiling, nominal/exact arithmetic, baseline/case/unused-branch checks and scoped parameters remain settled. Default serde_json recursion rejection stays enabled. Schema8 codec/allocation/output/lifecycle closure, source8, evaluator, package environment, capture, API/CLI/UI and historical/transition parity remain pending; this is not a runnable release or complete product transport. Gitea issue1 comment291 records the resume lease; root owns integration/publication and any subsequent compiler-driven corrections.

## Historical reboot freeze

Codex-956atf /root/requirements_delta, 2026-09-11. **Frozen immediately at the user's reboot checkpoint; uncompiled work, not a runnable product. Do not resume without root follow-up after reboot.**

Worktree: `C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-core-worktree-20260911`, branch `codex/analysis-core-20260911`, base `7d14bd0dd1cf4a2293c00c185573fd4a7fc364ae`. All edits in this assignment are in that isolated worktree. Root retains commits, pushes, builds, integration and the original checkout. No manifests, lockfile, source8 grammar, evaluator, server/CLI/UI, generated schemas, ledgers or prior frozen reports were edited.

## Coherent implementation present

- Schema8 `Project.definitions` is required. Local quantity-kind, unit and pure calculation definitions share global UUID/alias/header identity; `ParameterId` is scoped to its calculation. `DefinitionRef::Local` is the only admitted reference variant. Imported packages are not simulated.
- Three explicit `SharedBody` records implement property-owned bases, subjectless or subject-bearing one-level cases, and shared checks. `Binding::{Unbound, Expression}` has no persisted Clear/default-case state. The closed expression/type vocabulary is in `analysis/types.rs`.
- `analysis::admit(&Project, AdmissionLimits)` returns the resolved kind/unit/calculation environment, accepted limits and usage. `effective_binding(property, ModelBaseline|Case(id))` returns the selected binding and its origin; it does not evaluate. Private bounded `KindHandle` contains project and definition UUIDs and is valid within one admitted environment.
- Static checking uses pure `NumericType` result helpers also used by `NumericValue`. It checks every stored branch, pure parameter scope, exact call arguments, declared/display types, same-layer subjects/property reads/case targets, affine kinds/units, flat homogeneous lists, acyclic calculation/effective-property dependencies, logical depth128, call depth32 and stored closure65,536. Checks may be Boolean false; supported runtime domain failures such as 0/0 do not become typing errors.
- Root ratified the provisional static ceiling1,000,000 events, explicitly lowerable and separate from runtime work. One meter spans the document and every effective case; it latches on exhaustion. Final ceiling acceptance still needs a measured gate. This meter is analysis work accounting, not a bound on all existing architectural validation or JSON allocation.
- Commands add Create/EditDefinition, SetAnalysisBase, SetAnalysisOverride and ClearAnalysisOverride. General element creation/editing remains the actual shared command path. Reidentification rewrites property/local-definition references and case keys, preserves scoped parameters, and rejects colliding keys before mutation. Deletion retains live analysis dependencies, so the same transaction must repair or remove them. Existing Session history/provenance is reused.
- Frozen schema5/6/7 JSON envelopes migrate with an empty catalog and reject new fields/kinds. Existing descriptive units/constraints remain strings. `language.rs` contains only old-source compatibility/refusal and record-count glue. Explicit guards refuse header-only semantic review or transition of analysis records.

## Evidence and remaining risks

**22 tests are prepared, zero were compiled or executed by this worker:**21 actual-Project tests and one static-meter test. The independently specified complete17-UUID response-budget fixture covers shallow JSON reopen, base/case/Unbound selection, commands/history, identity domains, atomic deletion repair, case-only cycles, unused branches, parameter purity, types/units, R6/runtime agreement, lists, logical/call/closure boundaries, aggregate static work, transport record counts, closed wire input, old-schema metadata preservation and unsupported review/transition refusal. The expected mixed-unit evaluation totals are not claimed; there is no evaluator in this lease.

Standalone rustfmt parsed/formatted the new modules, migration_v7 and changed numeric quantity file. A read-only `git diff --check` before the stop request was clean. Neither is a compile/test gate. Root reported the earlier numeric foundation at7d14bd0 passed26 tests; that result does not cover this WIP or its modified numeric helper code.

The default serde_json recursion guard is deliberately unchanged. Some programmatically admitted depth128 trees cannot reopen through the current decoder. Pretty serialization can exceed64MiB while semantic node limits still fit. Header `Value` allocation and per-Exact String/BigInt decoding precede aggregate static admission. Clone/Serialize/Debug/Drop and command cloning need the coherent bounded-codec/lifecycle gate. See the independent decoder review `harness/release-analysis-decoder-review-20260911.md` in the original checkout (Gitea#257). **Do not publish a runnable schema8 product before codec/output closure.**

Source8 parsing/formatting/update/history parity is pending: the model/schema header is8 while the existing source parser still accepts only3..7. Existing full source regression tests therefore cannot be represented as passing. Old synthetic tests that serialize a current Project after merely changing its schema number may need to remove the new catalog field to represent a real frozen old envelope. Generic factory creation refuses analysis kinds because required semantics cannot be defaulted.

Compiler/borrow/exhaustive-match checks remain outstanding. Static review was interrupted: the private typechecker binding helper has8 arguments and may trigger strict Clippy's argument-count lint; grouping its located binding context was the next cleanup under consideration, not applied. Review the static event precharge coverage of the call-argument arity/key scan before treating its weights as final. Existing architectural validators still have their own scaling costs. No claim of full decoder safety, source parity, frozen export, package compatibility execution, approximate mathematics or finished release capability is made.

## Exact edited paths

All paths below are relative to the isolated worktree, not the original checkout. This report is the only additional edited file beyond this20-file inventory.

| Path | SHA256 at stop |
|---|---|
| `crates/oa-core/src/analysis.rs` | `7C197D80CD6C5A17345E9ABD20107CF9EE1887A77596144A8FAADB3253A9664B` |
| `crates/oa-core/src/analysis/admission.rs` | `60661ADEBFBDFA2A04A354A106D3DB3F81821EF4A50786A6CF611988666FDB85` |
| `crates/oa-core/src/analysis/references.rs` | `FE50EDC049B9900D91CADE3F58D15ACA4101211C39BB090317F548259D634529` |
| `crates/oa-core/src/analysis/resolve.rs` | `67AAA97DA8190DEDE71F0E2F98F1884A1DA38596B4B2DC6F8D61FF4377BDC80F` |
| `crates/oa-core/src/analysis/typecheck.rs` | `23F13E0EF971E794210FB3886178E1145661E4BC668A50B753F7BAAA9591035E` |
| `crates/oa-core/src/analysis/types.rs` | `CFD03E2B01D34AE6979403458D9861B7B1252383A2313CB56133AB64167F72B2` |
| `crates/oa-core/src/analysis/tests.rs` | `7137A47E994E629D7F349D023F32C10FD0563261678E59878A23E3BF6A101F05` |
| `crates/oa-core/src/analysis_numeric/quantity.rs` | `B9F23A9485F8BD913722023C35FB9D8917C9F160078655B3A5C52C8F7F12AB94` |
| `crates/oa-core/src/language.rs` | `B65098321ECF79E4DC1182A7FAB7BAFEEC0A238BB56153E81782F04FAB838558` |
| `crates/oa-core/src/lib.rs` | `C9BF3462A57A465B6CC7ECD7866E0D331B35F299E89D9C917E0A4587BB1DCD89` |
| `crates/oa-core/src/migration_v4.rs` | `BF4056DA11AC4F27627320742539CC2408ED42334106F3068C432FF70C62DB25` |
| `crates/oa-core/src/migration_v7.rs` | `474F4CEBDD343A7EECDF243149BBCBF08E12EAA05B8532BF2593705287017B30` |
| `crates/oa-core/src/model.rs` | `1C06BCC4AA7ABFEF89876C3A001171C742558D664612CF36152AC0AA52BC7BAF` |
| `crates/oa-core/src/persistence.rs` | `30B05FA464C49629080F3E20C6D3DA5226858A99B7C4C9554356847F8A5975EE` |
| `crates/oa-core/src/references.rs` | `63CD8655F67D919CC8F6B796F4CEC42D7B020AA37880E50F19190AAB8B0029A3` |
| `crates/oa-core/src/semantic/catalog.rs` | `47D74ACC4862139BA835DB3D6B769411E27860A99426A7F03EDEA26F44F7F7B3` |
| `crates/oa-core/src/session.rs` | `06115011BC86F0C95BBBE6D14BDAEDD7B83A66C0104DB186900B0F047B0F9C43` |
| `crates/oa-core/src/transitions.rs` | `127E429BCA4B2EA9A189ECE7E7B6DFD05A30B5FDEE98B2D10288A6F7C17B5931` |
| `crates/oa-core/src/validation.rs` | `E4C61F5ABB22AE3E595E16E93472E4364CDE4DB9064EC6DF826228C3D5962E42` |
| `crates/oa-core/tests/source7_contract.rs` | `0702D3BD0173DEF4F67770458E4AF2B23F213FD5938EE70E3AE0042897EF5F1E` |

## Next authorized gate after reboot

Root first preserves/pushes this WIP and confirms the exact checkout. After root explicitly resumes work, the proposed narrow root-owned command from this worktree is `cargo test --locked -p oa-core --lib analysis:: -- --test-threads=1`, using the established toolchain and root-selected target directory. Fix actual compiler/test findings, rerun modified numeric tests, then strict core Clippy; only then continue independent review and coherent bounded codec/source8/evaluator integration. This worker has not run that command and will remain stopped.