ARCADIA-Studio/harness/release-chain-assembly-contract-independent-review-20260906.md

# S1 contract independent review — 2026-09-06

Read-only review of `release-chain-assembly-contract-probe-20260906.md`, its
isolated resolver probe, current validation/reference/source/recovery seams, and
the proposed S2 contract. No production edits, Cargo, or native input.

The central representation is sound: explicit caller owner, ordered reference
**occurrence** IDs, and a leaf occurrence distinguish repeated and nested uses.
Keeping old direct SequenceLink unchanged avoids inventing historical semantics.
The three closed purposes appropriately avoid equating common work with merged
execution. The following corrections should be frozen before production wiring.

## 1. Deterministic admission must not depend on resolver cache history

**P1 contract correction.** `Index::resolve` in the probe rejects a new address when
`cache.len() >= max_addresses`. The contract proposes sharing the accepted-revision
index with GUI endpoints, validation and other consumers. Together, those choices
can make a model's apparent validity depend on which preview addresses were visited.

Minimal falsifier: max_addresses=1; authored model needs only valid address B.
Fresh index resolves B. On the same accepted Project, first preview unrelated
valid A, then resolve B: the probe returns `resolved address limit`. Reversing the
interaction order changes the result without changing the model or authored budget.
The probe demonstrates a cache cap, not yet deterministic model admission.

Separate three budgets: deterministic counts of **authored** path components,
per-request/per-analysis expansion work, and cache storage capacity. Evict or skip
cache insertion when cache capacity is reached; never turn a cache miss into a
structural-invalid endpoint. Oversized requested expansion may explicitly refuse
or return an incomplete-analysis notice. Test cold/warm/evicted cache and changed
preview order yielding identical structural results and exact endpoints.

## 2. Shared source7 must freeze nested historical message serialization

**P1 compatibility correction.** S1 alone adds a new constructor and can preserve
existing element serialization. S2 adds `operation` inside existing Exchange
occurrence bodies. The combined migration cannot reconstruct old fingerprints by
changing only Project.schema_version and borrowing all current `p.elements`.

Current `recovery/source5.rs::Project5` deliberately serializes borrowed elements;
after a normally serialized default `operation: None` is added, an old message gains
`"operation":null` in those bytes. That changes its fingerprint even though the
accepted source has only a version-token change. The current empty-element literal
fingerprint test would not catch this. Current semantic recovery also explicitly
clears impact approvals on the admitted upgrade; preserve that behavior, rather
than treating unchanged engineering facts as proof that old plan approval survives.

Use one coordinated version7 admission/migration owner. Frozen source5 and source6
views must omit new message fields and reject new constructors, including explicitly
empty/default new fields under old advertised versions. Either a historical
serializer or carefully proved omission policy can preserve the old byte shape;
neither should be assumed from serde defaults alone. Pin old5/6 literal Projects
containing Call, Reply, values, direct SequenceLink, semantic history, and a saved
state/view selector, plus invalid raw workflow/property/source drafts. Verify exact
old hashes before restoring/replanning; do not rewrite raw invalid buffers.
New source7 combined S1+S2 snapshots need separate exact restore tests. This is a
coupled migration gate, not two independent schema-number increments.

## 3. Freeze deletion versus retarget refusal; never shorten an address

**P2 contract ambiguity.** The probe correctly rejects paths after referenced
records are removed/retargeted, but that does not define the normal Delete command's
accepted result. The proposed DTO has no unresolved owner/path/leaf representation.
The implementation must choose explicit cleanup or reject the whole command; it
cannot simply drop a deleted path component and reinterpret the same leaf directly.

Smallest consistent policy: normal Delete of caller/path reference/leaf removes
each dependent ContextualLink in the same reference-cleanup transaction, retaining
unrelated links and reusable definitions. Reidentify rewrites every exact typed
component. A generic reference-target edit that would invalidate a surviving link
rejects; an explicit previewed repair batch may delete/replace that link. Deleting
an assembly-purpose exchange/work similarly removes or explicitly repairs its
dependent link, never changes its purpose to Precedence. Freeze this policy or a
clearly specified alternative, then test Undo/source restoration and R2 isolation.

Also test caller-owner deletion when both leaves survive in external procedures:
using generic leaf source/target accessors alone will miss that ownership edge.
The accepted owner/reference visitor must include owner, each path member, leaf,
and purpose work/exchange. A source module update must follow caller ownership,
not the defining module of a surviving leaf.

## 4. Define which edges feed analysis before declaring the graph complete

**P2 semantic decision.** The contract distinguishes Precedence from Exchange and
CommonWork, but does not yet state which feed entry/exit/reachability/control
cardinality and behavior-coverage diagnostics. Current `validate_sequence` builds
direct SequenceLink adjacency; treating every new purpose as another execution
edge could create false split/merge warnings or suppress missing-coverage warnings.
Ignoring all contextual edges could report the accepted R1.B connection unreachable.

Freeze separate projections: contextual precedence adjacency, exchange/work
assembly incidence, and coverage evidence. Specify how direct links inside a
referenced procedure are qualified into each caller instance and how an outer
reference-node predecessor relates to entry/exit boundaries; do not count the
collapsed preview and its expanded contributions as two executions. Keep shared
P's own diagnostics separate from caller O's context. On analysis limits, emit an
explicit incomplete result, not success or guessed missing-path warnings.

A bounded discriminating test can use exactly R1/R2, A→B→C and X→R1.B, then add
CommonWork and Exchange purposes independently. Verify their intended diagnostic
effects and unchanged standalone P/R2 facts. This does not require a simulator or
a general execution semantics framework.

## Additional implementation checks, not new scope

- Generic source/target accessors returning leaf IDs are safe only after auditing
  caller-owner consumers. New contextual self-links must compare full addresses:
  R1.B→R2.B is not a self-link merely because the leaf ID is equal. Behavior
  navigation must select the explicit caller, not the leaf's defining procedure.
- Transition closure needs caller, every reference occurrence/target sequence,
  leaf, purpose work/exchange and their mappings. A target path is mapped component
  by component and re-resolved; neither the global work ID nor the first mapping
  is enough. Include two references to one callee and a conflicting retarget case
  in one frozen-base semantic-review test.
- Qualified source/target/purpose are coupled values. Semantic review can expose
  closed facets but must validate the complete composed relation and compare actual
  slots across rows; owner/path changes cannot silently reinterpret old leaf drafts.
- The probe's Precedence branch currently returns Ok without production guard-text
  or work/exchange adjacency checks, and it does not enforce the proposed ban on
  all-direct contextual Precedence. Its pass is endpoint-resolution feasibility,
  not complete admission parity. Add those decisive negatives when implementing;
  retain existing direct SequenceLink tests unchanged.

No further material address-identity defect was found in this bounded read. The
proposal remains viable after these decisions; none requires broadening S1 into
scenario gates, physical paths, scheduling, or arbitrary cross-owner edges.