ARCADIA-Studio/harness/experiments/analysis-mixed-rename-plan-20260924/RENAME-PLAN-TEST-REVIEW.md

Independent rename-plan test review

2026-09-24. Reviewed settled crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename/tests.rs in .local/as3batch; final raw SHA256 db20c27456ce264f02c2462c5b7c8790a5583d6d5ad7b0d6fc7820722083fb0f. Reread final freeze after the earlier8d6209 snapshot: rich failing-cap assertion now explicitly requires main.arcadia412..413; formatting/line endings were normalized. No remaining material test/oracle discrepancy found in these 17 tests. Compilation and actual same-profile admission/refusal remain pending parent gates. This review did not run Cargo, source tests, archived evaluators or application pipelines, edit implementation/tests, commit or publish.

Independent expectations

Compared tests with accepted root rename contract and independently authored RENAME-PLAN-ORACLE.md / rename_plan_bytes.py, not production-generated expected maps.

• OA/SA entire changed-name maps exactly match all11/12 qualified swaps. Complete physical maps match all27/28 original-coordinate tuples, including both cross-family reference directions, canonical a/b coincident offsets, both calculation parameter scopes, and reordered/repeated/nested call labels. Unicode-prefix/full-CRLF variants use independently authored exact endpoint arrays. Output sums900/943/974/1017 and retention38/40 are correct.
• Category literal full map equals all36 authored tuples for15 changed global targets. Corrected real line-comment-separated parent reference selects only344..345; implicit parent, historical UUID, display/prose/URI/guard text contribute no extra edit. Complete desired-name map, output2145 and retention51 match the oracle. Expectations are explicit literals, not copies of produced occurrence/edit maps.
• No-op checks external desired pointer, original bundle pointer, original model, zero edits/names, unchanged complete storage/usage/numeric counters and900 bytes. Rich success checks borrowed desired-name storage and untouched original/desired models. These are planning checks, not emitted/reparsed-source acceptance.

Inherited budgets and sizing

The38/37 test constructs a new parsed/resolved/typed-indexed/ordinary-indexed owner under the same supplied inherited profile before planning. It compares the admitted baseline then requires success retaining38 or exact entry-limit failure. There is no replacement/tightening of an accepted owner's budget. Independent arithmetic remains B=L+65, prior known peaks <=L+97 resolver/L+98 typed/L+93 ordinary, planning L+103; both caps L+102/+103 clear predecessors. Runtime must confirm the fixture actually reaches planning.

Additional relocated diagram fixture uses a fresh fourth canonical z.arcadia, preserves full model and sets the inherited B+37 profile through every predecessor. It requires failure in that included file at8..9, with exact limit diagnostic. This detects loss of canonical-file attribution on a late reservation. Its literal diagram relocation is ordinary valid include syntax; actual admission is not claimed before gates.

The930-byte case uses31 original n bytes, ordinary shrink30 and three typed f occurrences. Final renamed_f result924 must fit despite typed-only954; renamed_func result933 must fail930. Untouched b.arcadia's213 bytes are included. The test rebuilds the entire input pipeline under bytes930 and leaves other limits unrestricted. It does not disguise a predecessor failure: any such refusal fails the test before planning. Four edits and positive output924 are asserted; negative requires the exact output-byte-limit message.

Wide/deep fixtures independently count128 unary-chain sites and129 list sites; successful no-op equality, subsequent collision refusal and binding-variant refusal occur on a128KiB thread. Zero-E original refuses target-only2048-deep/4096-wide Expr variants. Nonzero-E list length growth/shrink and call argument removal reach matching-variant equality paths. These exercise the conservative E policy but do not establish a separate E/E-minus-one global-cap boundary. The rich no-op cannot isolate that boundary because its predecessor typed peak is larger, as already documented in the oracle. No contrary claim is made.

Whole-target and authority controls

Mutation groups cover project schema/identity/prose; collection removals/key changes; element identity/prose/parent/body; definition identity/prose/calculation parameter ordered identity/count/type/result/body; diagram identity/prose/layer/projection/view options/routes/nodes; node identity/element/geometry/collapse/port anchors; relation identity/prose/body; artifact identity/prose/owner/relation/URI/revision/fragment; trace identity/prose/endpoints/kind/baseline/semantic/history. QuantityKind algebra, Unit symbol and definition-body variant are explicit direct same_project controls; their deliberately synthesized Projects are not represented as admitted runtime fixtures.

Geometry signed zero is supplemented by admitted-source OA/SA Real minimum/default and historical RealMinimum values changing+0 to-0. Source inspection supports the fixture syntax: ordinary Real/Value encoding is valid; TraceKind::Item permits DataType↔DataType with canonical OA/SA endpoints; finite0/1 bounds and0 defaults are compatible. These facts remove a likely authoring error, but only pending gates establish actual admission. No non-name source rewriting is authorized by equality.

Final namespace tests distinguish changed→unchanged global collision, scoped collision, invalid/reserved/Unicode alias, and same spelling in separate scopes. Complete-bundle checks reject changed entry, missing/extra/path-renamed files, touched-byte changes and changed untouched a.arcadia bytes.

Corruption checks include missing/extra/wrong-target/out-of-file/empty/invalid UTF-8/extended-overlapping ranges. Safe fallback span/path are asserted for the malformed UTF-8 and missing file. Crucially, the final added scoped corruption substitutes P(11,1) for P(10,1) at main299..300: identical original x and desired y spellings cannot mask the wrong callee identity, and the test requires the exact missing-required-target diagnostic at the original file/span. Another added control inserts a valid unchanged node token and requires unchanged-target refusal. These reach deeper authority checks than simple f/g spelling mismatch.

Findings resolved before gates

Initial wide expression test used unsupported List<Number>; reported to implementer and corrected to List(Number), consistent with declarations grammar and existing literal tests. Initial wrong-target corruption failed on different f/g spelling before qualified association; the same-spelling scoped case now addresses that gap. Missing scalar/historical signed-zero, port-anchor, opaque definition and nonzero list/call-size controls were added and reread. No expectations were weakened to match runtime output; no runtime output existed during this review.

Parent must preserve all prior229-name outcomes (213pass/16known failures), original formatting failure and explicit source pin, and reconcile each new named test from actual logs. This is source-level evaluator review, not evidence that these tests compile/pass or that output emission, public source8, persistence, history or GUI/API parity is complete.

Narrow small-stack repair rereview — source70c20c3

After the initial source9388fcf2f0b82daffec93308f42949a612b07330 compiled but aborted its focused run on the small-stack test, the parent retained that failure, the exact original-artifact remaining16 passes, and diagnostic9e8e77e1/8159a17d attempts. The reported final markers locate overflow inside rejected helper's fresh authored(bundle) setup before that invocation entered rename planning. This identifies a test setup call boundary, not a proven compiler frame-size or cloning cause. Original hash/disposition above remains history, not a claim of17 passing tests.

Read immutable diff9388fcf2f0b82daffec93308f42949a612b07330→70c20c39de4d87633a3275fda3f2bc54b20e50b7. Exactly two files change: the small-stack test and its implementation-note failure/repair account. No production or other test/oracle change. Final test bytes SHA256 629fed6da8c59c9b5f3dd980f46476ce094cb6119841966492f623dd8d81f7af.

The test now directly constructs each fresh owner in the worker and matches the collision/non-name planning failure there, instead of nesting that entire admission chain in the general rejection helper. It explicitly asserts the complete failure messages, drops failure/desired before the next case, and drops original at iteration end. Still128KiB,128 deep unary sites and129 wide list sites; complete parsing/resolution/both indexes remain on that same worker. Successful plan/drop and both failure/drop paths remain for both shapes. No forget, larger thread, smaller fixture or skipped failure path replaces them. This is a faithful narrow setup repair; no further test change is requested from this review. All17 repaired focused tests and broader same-source gates remain pending parent verification; no runtime checker was executed here.

Compact case-loop candidate — sourcef1c0956

Parent subsequently observed another stack overflow at70c20c3; its source review above is not runtime acceptance and that failed attempt remains preserved. Read only the immutable70c20c3→f1c095654a5f2a8e1592415b1392644b27169e00 test/note delta. The new loop shares one source/desired/result local layout for modes0 unchanged,1 final-namespace collision,2 non-name Binding mutation. Each mode independently admits the full source on the same128KiB worker, verifies128/129 old expression sites, clones its desired model, runs planning, checks the appropriate success or complete diagnostic, and drops plan/failure plus desired. Both original deep/wide literals remain; all17 test names remain. No semantic case, source-admission stage or ownership/drop boundary was removed. No coverage objection to this narrow candidate.

The parent's observed70c executable fixed prologues (worker10872B, authored2984B, rejected1800B) are evidence about that binary's fixed frames, not an actual runtime call stack or exact overflow instruction. A shared-layout hypothesis motivates this candidate but is not a verified sole cause. This review did not execute tests or the frame inspector; f1c runtime and any compiled-frame comparison remain parent-owned and pending.

Planner-scoped worker rereview — source18073a6

The f1c compact candidate also overflowed; it is not accepted as a repaired combined pipeline. Parent subsequently reported debugger observations locating the failing f1c run3 inside upstream exact-literal parsing/BigInt allocation before rename planning, with one pass under debugger among three debugger runs. These parent observations explain the evaluator-scope decision; this source review did not independently replay the debugger, and a debugger pass is not ordinary runtime acceptance.

Read immutable diff f1c095654a5f2a8e1592415b1392644b27169e00→18073a6f2eabce83fc83997f094e331eec835a16. Test hash fa455ea90d9d220a18fa7eee9179eb5cc5895a5f7350197884126c66c18b60f7. Only the small-stack evaluator and implementation-note explanation change; production remains unchanged.

The actual code faithfully implements the independently reviewed narrower gate: for each deep128/wide129 shape and each of three outcomes it builds a fresh full admitted owner on the normal test thread, checks old expression count, creates the desired intent, then calls spawn_scoped with128KiB and a move closure capturing the owner plus borrowed &desired. plan_rename runs inside that closure. Success requires mode0, empty edits and the exact desired borrow, then explicitly drops the plan in the worker. Failure requires nonzero mode, one exact collision/non-name diagnostic and drops the failure in the worker; the consumed original owner is destroyed inside failed planning. The closure returns only unit. The scope joins before the external desired Project drops. No policy or live ledger is replaced and no source/edit authority escapes for destruction on a larger stack.

This is faithful to the accepted planner comparison/success-drop/late-refusal gate, not proof of full upstream admission on128KiB. All six planner cases, both old expression sizes and128KiB remain. The full-pipeline failed observations stay an explicit unresolved environment-sensitive stack boundary; existing independent admission/index small-stack tests do not erase them. No further source change requested by this bounded review. All17 final focused tests and five-gate runtime reconciliation still await parent readiness; no checker or Cargo was executed here.