12 KiB
Analysis candidate: next bounded acceptance experiment
Source-only independent review, 2026-09-13, Codex-956atf /root/nested_call_design; parent owns Gitea #7 and integration. No compiler, rustc, native UI, Gitea, candidate import, or production-switch changes were performed. Linux remains deferred. All commands below are proposals for the parent's next authorized compiler lease, not executed validation.
Recommendation
Run the existing public checked-save round-trip regression first, against isolated candidate 847b1caa7e75bb82f6ce5193c45bcfc45973ad1a. It is a smaller and more foundational experiment than adding memory instrumentation or more private depth fixtures. It directly checks whether ordinary user work can survive a successful source save. No new test is needed to expose the immediate boundary.
Working directory: .local/analysis-core-worktree-20260911 (branch codex/analysis-core-20260911; exact HEAD and clean status rechecked).
cargo test --locked -p oa-core --test review_regressions checked_save_returns_exact_bytes_and_accepts_unchanged_external_content -- --exact --test-threads=1 --nocapture
Input is the test's real Project::empty(), then a changed description containing Unicode 海岸 and a newline, saved using both .arcadia and .oa.json. Success requires exactly one selected test, successful save, disk bytes equal returned bytes, public decode equal to the complete Project, and repeat checked-save bytes unchanged. Preserve command, toolchain/linker/runtime identities, source/binary hashes, complete output and exit status. An unrelated build failure is a blocked execution, not a passed evaluator.
Predicted result, not an executed failure: the .arcadia iteration reaches its public decode assertion and rejects its own version-8 header. The candidate's language.rs:577 formatter writes SCHEMA_VERSION (8), while language.rs:1408 accepts only source versions 3–7. persistence.rs:932's checked-save implementation formats .arcadia directly and replaces the destination without the encode/decode equality check used by its JSON branch. review_regressions.rs:454 already tests precisely this closure. The existing private production_save_always_reopens_with_its_reader_profile test uses project.json; its success does not cover this source branch.
This is evidence of the documented unfinished source8 integration, not a new claim that the private JSON codec is broken. Merely accepting a version-8 header is insufficient: language.rs:593's declaration formatter does not emit the definition catalog, and language.rs:1653 explicitly rejects analysis records pending source8 authoring. Preserve the current test and failed artifact before repair. Do not weaken equality, silently omit new records, or enable DEPTH_128_VALIDATED to obtain a pass.
Verified evidence and source identity
Read the Windows gate, codec source review, candidate implementation handoff, relevant analysis decisions, and production integration plan:
harness/release-analysis-codec-windows-gate-20260911.mdharness/release-analysis-codec-source-review-20260911.md- candidate
harness/release-analysis-codec-implementation-20260911.md harness/DECISIONS.mdanalysis decisions andharness/release-analysis-production-integration-plan-20260911.md.
The archived Windows debug evidence covers the five-phase lifecycle driver, all six codec tests, analysis 28, numeric 26 and strict core all-target Clippy. The production depth switch remains false. It does not establish public source/API persistence, broad legacy regression closure, optimized peak memory, or all mixed-width/partial-value lifecycle cases. Archive harness/experiments/analysis-codec-windows-20260911 retains commands, logs and frozen inputs; the manifest SHA-256 is b9c8d1dde3047e2208243536f16357ed8d60da1be8f69512190eaa8e8e241a10. Its loaded unwind module was not captured; a PATH candidate is not proof of actual binding.
Recomputed SHA-256 of the candidate's relevant current bytes:
| Candidate-relative input | SHA-256 |
|---|---|
Cargo.lock |
19499d93dde6f2e2a00ab4b7d5f37689dd7a7d492b2b5e23063a761607839fc5 |
crates/oa-core/Cargo.toml |
3377d3d9d43fe0023ac09728b0d20205f86a6755f15518dc0cd035780b47a95d |
crates/oa-core/src/persistence.rs |
eda5e697adb29a8bf38b0d367099bd23267455e4792f97607e13dc0b232a3476 |
crates/oa-core/src/persistence/json_codec.rs |
2aa2c52eea794acb85744440192df9ef5193160ad6ebd1febaa824e144aadd90 |
crates/oa-core/src/persistence/json_codec/tests.rs |
7065cc9e177a5699432888110936529c621f13e7c4b164566ab1fd14b61d6b9c |
crates/oa-core/src/language.rs |
b65098321ecf79e4dc1182a7fab7bafeec0a238bb56153e81782f04fab838558 |
crates/oa-core/tests/review_regressions.rs |
f154e5c88d35e31512e2b07733a1327ea3e2fcfd1ef8eb23066a4e9573f387c1 |
Why this next step
| Candidate next step | Risk resolved / user relevance | Decision |
|---|---|---|
| Existing public checked-save test | Successful ordinary OA/SA source saves must reopen; exposes an immediate format/parser mismatch with no new harness | First bounded gate |
| Existing frozen migrations plus HTTP store restart | Preserves historical OA/SA identity, authored comments, revisions and coupled source/model representations | Follow after identifying/repairing the source boundary; several tests otherwise fail for the same staging reason |
| Mixed Expr width and partial legacy Value children | Tests small-stack allocation/unwind assumptions that five existing phases do not cover completely | Required before broader decoder-profile acceptance; does not fix source persistence |
| Optimized child peak-memory measurement | Calibrates finite cardinality limits against actual deployment resource cost | Required before ratifying depth/profile; no existing archived RSS runner found, and debug/private codec success is insufficient |
The user-facing milestone remains the plan's actual source-authored shared two-parameter calculation and property/check: ModelBaseline 7/4 seconds versus degraded 9/4 seconds, distinct Unbound versus cleared override, identical core/CLI/REST behavior. The proposed one-test gate is an early integration falsifier, not acceptance of that complete analysis feature.
Reusable follow-on acceptance, without inventing fixtures
After the first result and a separately reviewed source correction, run all three checked_save_ regressions. The other two already verify exact external draft bytes survive conflict and externally deleted files are not recreated, in both formats:
cargo test --locked -p oa-core --test review_regressions checked_save_ -- --test-threads=1 --nocapture
cargo test --locked -p oa-core --test port_migration --test r6_migration --test r3_migration -- --test-threads=1 --nocapture
The migration targets contain 8, 7 and 5 tests respectively. Reuse examples/legacy-v1-coastal-rescue.oa.json, tests/fixtures/v2-coastal-rescue.{json,arcadia}, v3-data-contract.{json,arcadia} and v4-reviewed-prose.{json,arcadia}. They cover frozen constructors, deterministic generated identities, collision rejection, strict duplicate/unknown fields, explicit upgrades, no-write loading and source comment preservation. A schema-staging assertion failure must be classified and repaired at its source, not relabeled as proven codec corruption. tests/language.rs also already has v1_text_and_json_migrate_deterministically_without_losing_legacy_semantics, malformed_json_never_ignores_duplicate_maps_or_nested_unknown_fields, and coordinate_bits_and_permitted_strings_survive_text_and_storage for deterministic migration, original-stream strictness, signed-zero/subnormal coordinates and permitted text across formats.
For the API boundary, reuse this existing real-transport test after core source closure:
cargo test --locked -p oa-server --test http source_projects::source_projects_upgrade_old_envelopes_without_writes_and_reject_inconsistent_pairs -- --exact --test-threads=1 --nocapture
Its old model-only envelope starts at revision 9; opening and no-op replacement preserve exact disk bytes, an authored comment update advances to 10 and persists both representations, corrupt model/source and unstabilized identities reject without rewriting, and restart retains the accepted SourceBundle. store.rs:116's PreparedProject::new formats a SourceBundle, compiles it and compares the complete model; thus API acceptance cannot be inferred from the private JSON reader. http/source7_contracts.rs's source7_http_instance_and_operation_edits_preserve_identity_source_and_restart adds practical shared procedure, instance and operation-item continuity. None of these existing tests establishes new analysis operations, evaluator semantics or new-definition source parity.
Missing codec evaluators, bounded after the first gate
Reuse persistence::json_codec::tests::codec_lifecycle_subprocess and its existing 128 KiB worker, 120-second child deadline, phase environment variable ARCADIA_CODEC_LIFECYCLE_PHASE, and exact child-status checks. The existing phases are accepted, refused, malformed, ownership, atomic. Do not claim arbitrary new phase names work before extending the dispatch.
- Mixed width/depth lifecycle: add a private child using meaningful mixed If/Binary/Unary/List/Call subtrees, including multiple branches and a populated argument map near logical depth 128. Cover full Project decode, clone/equality, streamed Debug, encode, checked save, reopen and drop, then a just-over-bound input and a valid subsequent decode. Existing shallow per-variant serde checks and balanced-tree typed decode do not exercise this entire combined lifecycle. Keep definition/parameter identities and type assumptions valid where admission is asserted. Also retain exact static-work/node refusal and unchanged-destination assertions.
- Partial legacy Value: use syntactically valid JSON with a legacy version (for example 5), an early wide retained subtree, then a late sufficiently deep subtree within the 512-container raw profile but beyond retained Serde legacy recursion admission. The version probe uses iterative
IgnoredAnyand can reach the materializing legacy stage. A malformed/truncated JSON document may instead fail in that probe and never exercise partial Value teardown. Instrument the intended stage in a private test or directly test the same legacy helper alongside the public decode control; prove the late failure stage. Pair with the deepest accepted Value and explicit iterative discard, plus a valid legacy fixture decode after refusal. Success is bounded normal error/drop, no abort/timeout, and no mutation—not acceptance of the extra unknown field as a legacy Project. - Optimized resource calibration: the existing release command below repeats lifecycle execution but does not measure RSS:
cargo test --release --locked -p oa-core --lib persistence::json_codec::tests::codec_lifecycle_subprocess -- --exact --test-threads=1 --nocapture
Extend a separate Windows runner/instrumented child to retain actual per-child process peak working set/private commit, duration, input/output sizes, exact loaded runtime module and binary identities for accepted/refused shapes. Measuring only Cargo or the driver misses child peaks; sampled RSS is merely a lower bound unless an OS peak counter is captured. Include broad accepted ordinary Project serialization/reopen as well as malformed late allocation, not just raw scanner counts. The profile's 64 MiB input bound, entry/node limits and stack segment sizes are not an RSS ceiling; encoding may retain original/output/reopened models simultaneously. Establish a documented resource acceptance budget before labeling measured numbers a profile pass. No justified numeric RSS threshold was found in the reviewed acceptance records.
The archived executable can help reproduce its exact five debug phases once runtime provenance and authorization are established; it is a lib-test binary and cannot substitute for the recommended integration-test target. Preserve the frozen archive and run new work under a new receipt label. Keep production depth admission conservative until the remaining evaluator and caller-boundary evidence supports changing it.