ARCADIA-Studio/harness/experiments/ordinary-source8-20260925/VERIFICATION-PLAN.md

Ordinary source8 compatibility: independent verification plan

Read-only source review against private baseline edf096cd33350865ecfc3c65ec266a6c0d3c4000 and selected root contract harness/ordinary-source8-compatibility-contract-20260925.md (parent identifies root fb9b0c5c). Implementation is currently uncommitted; this is a plan, not execution evidence. No compiler, application, CLI, or archived evaluator was run for this review.

Smallest useful gate set

Parent owns serial execution, source/artifact pins and available disk space. Reuse the existing target directory, jobs=1 and incremental=0 environment. Do not build the workspace. First list each selected target/filter and retain the actual nonzero name inventory; subsequent execution must cover those exact names. Commands below run from .local/as3batch; append -- --list instead of the execution harness arguments for inventory.

1. Run the new focused ordinary-source8 tests, the full core library, strict core all-target Clippy and the existing format gate. Preserve all 292 prior core names and compare actual outcomes, rather than merely subtracting the old 16 failures. The six language::nesting_tests and ten source_files::transaction_tests formerly stopped at schema admission; their newly reached assertions matter. Transactions are a library module, not a separate integration target. Keep all private acceptance and existing stack controls in the full library suite. Existing persistence::source_save_tests must continue refusing malformed, lossy and migrating generated output before staging.
2. Run these existing complete integration targets, each with cargo test --locked --offline -p oa-core --test TARGET -- --test-threads=1: source_project, source_identity_updates, source_nested_updates, source_files, and r3_migration.
3. Run cargo test --locked --offline -p oa-core --test review_regressions checked_save_ -- --test-threads=1. Inventory must contain exactly the three checked-save functions below. The rest of that large integration target is not required just to establish this compatibility repair.
4. Run the named source7 migration/update test below after repairing its stale fixture assumption, using --test source7_contract source7_source_bundle_migration_is_token_only_and_new_link_stays_with_caller -- --exact --test-threads=1 after the common Cargo prefix.
5. Build only the actual non-test consumer with cargo build --locked --offline -p oa-cli --bin arcadia, then perform the read-only commands below. crates/oa-cli/Cargo.toml defines binary arcadia; do not guess an oa-cli.exe filename. Record the resulting executable's actual path/hash and source/environment binding.

These targets are Cargo's ordinary tests/*.rs integration targets; core Cargo.toml does not require a special feature. Selecting complete related targets avoids silently omitting newly reached assertions while limiting separate test binaries. The CLI integration target source_cli is useful existing coverage but is not a prerequisite for this minimal set: its tests also perform saves. It is not a substitute for the requested actual read-only schema8 consumer invocation.

What the integration targets establish

Target	Source-backed discriminating names and purpose
source_project	cross_file_typed_ports_global_forward_references_and_stable_ids; advisory_lint_locations_refer_to_raw_drafts_before_identity_stabilization; source_errors_keep_exact_fragment_unicode_positions; generated_id_insertion_handles_adjacent_header_tokens_and_remains_exactly_indexed; model_updates_rewrite_cross_file_alias_uses_preserve_ownership_and_untouched_comments; failed_update_preserves_candidate_and_rejects_stale_index; scalar_header_guard_and_project_edits_preserve_exact_crlf_trivia_and_escape_spelling; alias_updates_touch_only_header_and_reference_tokens_even_with_comments_after_at. Also covers includes, aggregate admission, canonical export and whole-model updates.
source_identity_updates	All three: identity_and_alias_edit_keep_authored_file_and_reference_rationale, identity_swap_and_reorder_keep_both_declarations_and_item_comments_with_origin, provenance_cannot_merge_records_or_cross_record_classes.
source_nested_updates	Includes nested_scalar_edits_touch_only_authored_tokens, cross_file_move_carries_attached_comments_and_subtree_but_leaves_gap_notes, nested_uuid_alias_swap_and_cross_file_move_follow_command_provenance, nested_typed_reference_list_updates_keep_item_rationale_while_port_moves, crlf_moved_and_new_children_preserve_authored_and_destination_line_endings, and deep_structural_writeback_runs_on_a_small_thread_stack; other cases cover reparenting, deletion, lexical ownership and nonoverlapping edits.
source_files	loading_keeps_original_no_uuid_bytes_and_saving_stabilizes_exactly_once; discovery_never_refreshes_drafts_and_preserves_detached_buffers; unchanged_dependency_edits_and_deletions_block_save_before_any_write; new_destinations_require_explicit_missing_expectations_and_reject_collisions; forged_compiled_model_or_index_cannot_be_saved; actual aggregate/path/hard-link safeguards. Unix-only symlink, named-pipe and permission tests are excluded by cfg on Windows: do not claim they ran.
r3_migration	In particular authored_v4_modules_upgrade_only_the_version_and_preserve_nested_comments, which recompiles migrated bytes idempotently and preserves the caller's draft; frozen_v4_json_and_source_preserve_the_old_review_without_fabricating_semantics; older_headers_cannot_admit_new_semantic_baselines; original_v1_v2_v3_inputs_complete_the_explicit_upgrade_to_five. Current source3–7 coverage must additionally come from the new focused regression; a historical function name is not a current output-schema assertion.

The three review_regressions.rs:454.. functions are checked_save_returns_exact_bytes_and_accepts_unchanged_external_content, checked_save_rejects_external_changes_and_preserves_their_exact_bytes, and checked_save_rejects_external_deletion_without_recreating_the_file. Each loops over project.arcadia then project.oa.json in that order. A successful function must now reach its second JSON branch. They check exact returned/disk bytes, whole decoded model, unchanged repeat, external edit preservation and deletion refusal. Previously failing first-source behavior could mask JSON behavior; do not count an early source failure as JSON evidence.

Concrete static issue: source7_contract.rs:1035 creates current formatter output, then attempts to replace literal arcadia 7; with a commented schema6 header. It also expects migration to literal 7;. Current formatter output is schema8, so the initial replacement does not downgrade it and the later migration unwrap is unsupported. Repair the fixture explicitly to construct old6 from the actual current header and expect current-schema output, retaining exact comments/module bytes, whole-model equality, relation ownership and recompile checks. This is an evaluator correction, not permission to remove the test or weaken migration behavior. Report any further newly reached stale expectations individually.

Actual read-only CLI oracle

Create a fresh isolated fixture directory outside source, with exactly three UTF-8 files without BOM. Each shown \r\n denotes actual CRLF; use byte writes so shell newline handling cannot change the oracle. UUID literals below are complete.

project.arcadia:
// 雨\r\narcadia 8;\r\nproject p "Project" id "00000000-0000-0000-0000-000000000001" {\r\ninclude "participants.arcadia"; include "children.arcadia";\r\n}\r\n

participants.arcadia:
// @team remains documentation\r\noa_entity team "Team @team" id "00000000-0000-0000-0000-000000000002" {}\r\n

children.arcadia:
oa_entity child "Child" id "00000000-0000-0000-0000-000000000003" { parent @team; }\r\n

Run the built executable (absolute path) twice, capturing exact argv, exit status, stdout and stderr:

arcadia.exe check <absolute-fixture-entry-path> --json
arcadia.exe rename-alias <absolute-fixture-entry-path> team rescue_team --json

These are actual arguments() forms in crates/oa-cli/src/lib.rs, dispatched by main.rs. Neither includes --write. Explicit IDs remove random UUID allocation from the expected report.

Expected common report fields: format_version=1, supplied entry path, exit_code=0, written=false, identities_to_stabilize=0, migration=null, and no diagnostics for these named ordinary entities. Check reports operation="check", status="checked", changes=[]. Rename reports operation="rename-alias", status="preview" and exactly two changes ordered by path: children.arcadia, participants.arcadia. Each before must equal its complete original literal. The complete expected after is the same literal with only parent @team; changed to parent @rescue_team; in children and only the declaration oa_entity team changed to oa_entity rescue_team in participants. The comment and display-name @team remain byte-identical. No entry-file change is permitted. Check the human diff reflects those same edits; complete after bytes, not diff presence, are the decisive oracle. Notes are explanatory implementation text and do not authorize a write.

Before either invocation record sorted directory inventory and every file's full bytes/length/SHA256. Compare all three actual files and the complete directory inventory immediately after each invocation; report output is not proof of unchanged input. In particular project.arcadia remains identical both on disk and absent from reported changes. Keep captures outside the fixture directory so they cannot confuse this check.

The CLI JSON schema does not expose the whole resolved Project. Do not invent such an assertion from report fields. Semantic expectation is unchanged project UUID/name, unchanged entity UUIDs/names/parent identity, with only ID2's alias becoming rescue_team. The existing whole-model integration assertions provide the supporting model evidence (source_project updates and identity tests). If a candidate-specific CLI-result whole-Project equality is required, add a small parent-owned test through existing public compile APIs that assembles the literal reported candidate and compares a fully authored Project; keep it distinct from the non-test CLI invocation and do not add a production export command. Existing oa-cli/tests/source_cli.rs::alias_rename_across_modules_changes_only_live_tokens_and_retains_all_identity demonstrates that model check, but also writes and uses a legacy schema7 setup; it is not the read-only current8 fixture itself.

Admission and limits

Retain initial failures and exact source/test changes separately from repaired outcomes. List and execute on the same frozen candidate; retain receipt inputs, Git/disk equality, launchers/environment, executable hashes and raw outcomes. Investigate newly exposed JSON-save or transaction errors at their own layer. Full ordinary source8 compatibility does not imply support for analysis constructors, typed source syntax, complete typed formatting, depth128 qualification, or publication. Preserve DEPTH_128_VALIDATED=false, existing parser/storage/depth policies and the full-pipeline small-stack limitation. Linux remains user-deferred; cfg-excluded tests are not Windows passes. This plan adds no workspace-wide build and makes no acceptance claim.