Record verified private emission and parser stack repair

2026-09-24 18:34:34 -07:00
parent b2ef3f5457
commit d5b37f13fd
14 changed files with 909 additions and 3 deletions
@@ -639,3 +639,30 @@ This changes representation without new heap storage or weaker tests. Prefer
 this to boxing policy or introducing an external policy-owner lifetime. The
 debugger identifies the active parsing path; it does not prove a sole cause or
 establish that the representation repair passes before it is actually tested.
+
+## 2026-09-25 — separate owned emission from accepted rewritten output
+
+The [emission contract](analysis-mixed-emission-contract-20260925.md) consumes
+the validated plan. A no-op returns its original owner; changed emission reserves
+the complete output map and UTF-8 storage while the old plan is live, then copies
+each file once in original edit coordinates. It drops old auxiliary ownership
+before constructing the private pending result. Exact policies and the desired
+whole Project survive, but no parse, adoption, save or public editing authority
+is granted. Reject any borrowed carried owner on the changed path: dropping a
+guard cannot free the externally owned allocation. A future owning transition
+must consume that allocation or account for its continued lifetime explicitly.
+
+The [source-bound Windows evidence](experiments/analysis-mixed-emission-20260925/README.md)
+preserves an initial full-run stack abort and the successful repair. Split the
+existing iterative binding driver's prefix and continuation operations rather
+than changing arithmetic, increasing stack sizes, boxing state or weakening
+tests. Independent review establishes mechanical equivalence; actual rebuilt
+prologues and unchanged runtime controls support the bounded stack reduction.
+This does not close the older, separately unrerun full-pipeline setup limitation.
+
+Final acceptance still requires parsing and resolving actual output bytes,
+complete Project equality under justified scratch bounds, explicit parser
+producer timing and an owner retaining the accepted bundle. Original expression
+counts alone do not bound an arbitrary faulty output. Logical auxiliary usage
+continues to exclude the established model/serde/validator and allocator domains;
+no process-wide memory guarantee follows from this private milestone.
@@ -283,9 +283,21 @@ ownership and aggregate phase accounting survive parsing and resolution;
 legacy checkpoints remain unchanged. An initial full-run stack regression was
 corrected by retaining a smaller guard, with the existing 128 KiB controls
 unchanged and passing. The earlier separate setup overflow remains unresolved.
-New continuation constructors are fixture-only; output creation and accepted
-editing are not implemented. Stronger parser allocation-timing obligations
-remain open. [DECISIONS.md](DECISIONS.md) records the scope and rejected
+At that checkpoint, continuation constructors are fixture-only. The subsequent
+[private output-emission contract](analysis-mixed-emission-contract-20260925.md)
+is implemented at **8d52dab97c92cc31baae9f20d8c324b55818aa5d** on
+`codex/analysis-mixed-emission-956atf-20260925`.
+Its [Windows evidence](experiments/analysis-mixed-emission-20260925/README.md)
+records eleven new passes and a completed 269-name full run with **253 passed /
+16 unchanged failed**, strict core all-target Clippy and identical inherited
+formatting failures on 555 unchanged inputs. The consuming no-op preserves the
+original owner; changed output reserves all owned source storage before copying
+and remains private and unverified. Borrowed carried owners cannot use the changed
+path. An initial stack abort is preserved; a mechanical parser split reduces
+the observed numeric-prefix prologue reservations by 13,032 bytes, and the
+unchanged overflowing control passes the final suite and three fresh processes.
+Accepted editing and stronger parser allocation-timing obligations remain open.
+[DECISIONS.md](DECISIONS.md) records the scope and rejected
 alternatives; live ownership and acceptance remain in issue7.
 The preceding Project [Windows evidence](experiments/analysis-mixed-project-20260924/README.md)
 distinguishes runtime source **71cadfa0cd0e112caa29588d2494753301f3cb6c** from
@@ -0,0 +1,4 @@
+*.md -text
+*.py -text
+*.txt -text
+*.json -text
@@ -0,0 +1,96 @@
+{
+  "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+  "baseline": "fa7a980418ef99d772e67c66c28dfa7b5181f875",
+  "baseline_archive_sha256": "2eca143b706458c1c0217af715fa6f17c01a0b9f85a5313d6a231dabe1aba7c9",
+  "checker_sha256": "aec366f529b9c8466316a304bcc7ca6688863be2b8da88f03d94cb6a8114019b",
+  "inputs": 555,
+  "unchanged_old_outcomes": 258,
+  "added_passed": 11,
+  "added_names": [
+    "language::analysis_source::mixed::carried::tests::emission_refuses_changed_carried_even_zero_and_preserves_noop_guards",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::combined_growth_shrinkage_emits_original_coordinates_and_complete_untouched_file",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::complete_categories_preserve_trivia_implicit_parent_and_historical_uuid_bytes",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::exact_all_policy_fields_and_pending_outlives_original_bundle",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::exact_real_single_and_chain_overlap_caps_and_complete_owned_bytes",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::existing_edit_validation_runs_before_both_transitions",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::four_file_cross_family_swap_preserves_entire_untouched_file_and_comments",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::noop_returns_identical_owner_below_output_overlap_and_releases_desired_borrow",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::scoped_small_stack_changed_unchanged_and_failure_drop",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::whole_rich_oa_sa_scoped_global_swaps_and_unicode_crlf_bytes",
+    "language::analysis_source::mixed::project::ordinary_index::rename::emission::tests::wrong_branches_and_complete_stale_current_refuse_before_output"
+  ],
+  "full_passed": 253,
+  "full_failed": 16,
+  "identical_failure_blocks_after_pid_only_normalization": 16,
+  "identical_fmt_sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d",
+  "artifact": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\analysis-checked-save-target-20260913\\debug\\deps\\oa_core-416e35542925bed6.exe",
+    "bytes": 42402816,
+    "sha256": "29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446"
+  },
+  "environment": {
+    "CARGO_TARGET_DIR": "C:/Users/User/Documents/Git/ARCADIA-Studio/.local/analysis-checked-save-target-20260913",
+    "CARGO_BUILD_JOBS": "1",
+    "CARGO_INCREMENTAL": "0",
+    "CARGO_HOME": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\toolchain\\cargo",
+    "RUSTUP_HOME": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\toolchain\\rustup",
+    "RUSTFLAGS": null,
+    "RUSTC": null,
+    "RUSTUP_TOOLCHAIN": null,
+    "ARCADIA_CODEC_LIFECYCLE_PHASE": null,
+    "RUST_MIN_STACK": null
+  },
+  "receipts": {
+    "emission-focused-8d52dab-1": {
+      "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+      "exit": 0,
+      "outcomes": 11,
+      "listing": 0,
+      "log_sha256": "12aa7f28ce98e6ddbcda7a9c99b90748e96eb91d41ba0db825c71814fb99471c",
+      "result_sha256": "e8f025c0a99a2da2ed99dc249553c5d0c68970891f1dfcc0a28c58ee2685e443",
+      "inputs_sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50",
+      "launcher_sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    },
+    "emission-full-8d52dab-1": {
+      "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+      "exit": 101,
+      "outcomes": 269,
+      "listing": 0,
+      "log_sha256": "1a31c94c3f0a0b6157be381118ee6a9d708b3241c545c8d7f99bc3de94d78871",
+      "result_sha256": "431a7080e8d8279b4cd4dc1da039acf021200018a052de047c4927ef461f07a4",
+      "inputs_sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50",
+      "launcher_sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    },
+    "emission-list-8d52dab-1": {
+      "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+      "exit": 0,
+      "outcomes": 0,
+      "listing": 269,
+      "log_sha256": "a32bff2e98b6ca5e72e9d2c07df0068cb31b30f013824d35c2a639499c3c4e38",
+      "result_sha256": "cd28c5314dedc75b1b00ab93482c06f6655e45c4aadf938ea4b75031a4929d0b",
+      "inputs_sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50",
+      "launcher_sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    },
+    "emission-clippy-8d52dab-1": {
+      "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+      "exit": 0,
+      "outcomes": 0,
+      "listing": 0,
+      "log_sha256": "cf4f2df3c1c461e7df0f16cab11fb23d64c003af7914b2a3e772a25bdb0b5a4a",
+      "result_sha256": "15695a8f44e699680831072ffd4270be13582834b3935edafe237f24ed3ccc57",
+      "inputs_sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50",
+      "launcher_sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    },
+    "emission-fmt-8d52dab-1": {
+      "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+      "exit": 1,
+      "outcomes": 0,
+      "listing": 0,
+      "log_sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d",
+      "result_sha256": "8b96257054feb09bea714724adeebb40056617a64f4ce84b44825a90f34541a7",
+      "inputs_sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50",
+      "launcher_sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    }
+  },
+  "scope": "Committed declared inputs, pinned baseline archive, raw logs and current artifact bytes; no Cargo/executable execution. Launcher semantics require independent source review."
+}
@@ -0,0 +1,15 @@
+# Independent package readback
+
+2026-09-25. PASS: no actionable package discrepancy found. Reviewed source `8d52dab97c92cc31baae9f20d8c324b55818aa5d` and the immutable evidence ZIP: **65 members, 479,039 bytes**, SHA256 `8d46b31379d75567b195b639cb3bc289ad1c9d26df53d29dbfd99ba22e38c5b9`. Manifest SHA256: `ac6df312f15efee4c1656d01ddb26379d653d88593edf003f8617447947a476c`.
+
+Independently verified ZIP CRC, unique safe member names, exact manifest membership, and every member length/hash. All 63 file members match their original local gate, baseline, diagnostic, contract, review or packaging-helper bytes. Both remaining members match exact Git diffs (`fa7a980418ef99d772e67c66c28dfa7b5181f875` to final; `19a4082117b88caf332198e4c685bde91005cb52` to final). All seven readable mirrors match both archive and original review files. Baseline records also match the previously published carried-phase ZIP, SHA256 `2eca143b706458c1c0217af715fa6f17c01a0b9f85a5313d6a231dabe1aba7c9`.
+
+Independent in-memory readback verifies all **555 declared inputs** against immutable Git blobs and current raw files, final HEAD and clean tracked source, receipt/log/input/launcher hashes, and final gate status. Raw results contain **253 passed / 16 failed**, exactly **11 new focused passes**, and **269 listed names**. All 258 previous outcomes and all 16 failure blocks match the baseline, normalizing only numeric thread identifiers. Strict core all-target Clippy exits 0. Formatting exits 1 with byte-identical baseline output, SHA256 `c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d`. This remains a failed full suite and failed formatting check.
+
+The initial full run remains an abort: 135 completed passes followed by exit `3221225725` (`0xc00000fd`). Its separately retained 42,402,816-byte artifact hashes to `777457cfefb8a3046e3f0809cabd936cfb742abe792befad2c50e05dfac1bf6b`; the equally sized final artifact hashes to `29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446`. Both identities were checked against actual bytes without execution. The debugger trace retains Exact decimal parsing and binding frames plus explicit process termination; debugger exit zero is not a passing test.
+
+Archived disassembly binds initial binding's 27,272-byte reservation and final binding/prefix reservations of 2,520 + 11,720 = 14,240 bytes: a 13,032-byte reduction in those selected frames. Continuation is mutually exclusive with prefix and reserves 13,416 bytes. These figures are not total live stack use. Each of the three separate control receipts/logs records the exact unchanged ordinary-index test passing in a fresh process, with final source/artifact identity and matching helper hash. The inspected helper rejects stack overrides and stops on failure; it was not executed during this audit.
+
+README, relevant STATE and DECISIONS entries preserve private **unverified** output scope, initial failure, inherited failures, the separate older unrerun setup limitation, and pending actual-output parsing/resolution/equality/ownership obligations. No public editing, universal stack safety, broad before-growth accounting, Linux execution or new release is inferred. Relative Markdown links in the packet reviews/README and root STATE/DECISIONS resolve with this readback present. Historical `PID` labels in the runtime checker/report refer to the normalized Rust thread identifier and do not change the comparison.
+
+Only read-only Git, source/data inspection, hashing and independent Python assertions were used. No archived helper, Cargo, test/product executable, debugger or network operation was run; the existing runtime checker's output was not overwritten. The ZIP, manifest, gate records, code and original reviews remain unchanged. Publication remains the parent's responsibility.
@@ -0,0 +1,82 @@
+# Private owned emission and parser stack repair
+
+Source **8d52dab97c92cc31baae9f20d8c324b55818aa5d** is pushed and ref-verified
+on `codex/analysis-mixed-emission-956atf-20260925`. It implements the
+[private emission contract](../../analysis-mixed-emission-contract-20260925.md):
+consume a validated rename plan, preserve its exact owner for unchanged output,
+or reserve complete owned output storage before copying changed files once in
+original edit coordinates. Changed output is opaque and unverified; the exact
+policies and desired whole Project survive. Borrowed carried owners are refused
+on the changed path because dropping their guard cannot free their backing
+allocation. There is no public source8, save/history or accepted-output authority.
+
+Windows gnullvm, rustc/Cargo 1.98.1: **11 new tests pass**, strict core all-target
+Clippy passes and the listing contains **269 names**. The full library remains
+**FAILED: 253 passed / 16 failed**. All 258 prior outcomes and all 16 failure
+bodies match fa7a980 after normalizing only numeric thread identifiers.
+Formatting remains **FAILED** on eight inherited blocks in five files, with
+byte-identical output. Linux/WSL checks were not run.
+
+[Source review](SOURCE-REVIEW.md), [test review](TEST-REVIEW.md) and the
+[independent oracle](../../analysis-mixed-emission-design-20260925/EMISSION-ORACLE.md)
+cover complete OA/SA bytes, Unicode/CRLF, scoped and global swaps, untouched
+files, freshness and branch refusal, policy/lifetime retention, exact storage
+caps and scoped drop behavior. Minimal and three-file fixtures reach real
+emission peaks of 17 entries / 114 text bytes and 29 / 216 respectively;
+their cap-minus-one controls pass predecessor phases and refuse emission.
+The no-op returns the original owner below output-copy overlap limits.
+Two fixture issues were corrected before execution and are disclosed in the
+test review; neither is presented as a runtime failure.
+
+The [stack diagnosis](STACK-DIAGNOSIS.md) preserves source19a4082's initial
+full-run abort after 135 completed passes. All eleven new focused cases had
+passed, but an unchanged 128 KiB ordinary-index control overflowed during its
+upstream numeric parsing. Exact-artifact LLDB and prologue records are retained.
+The [mechanically reviewed repair](STACK-REPAIR-REVIEW.md) splits the iterative
+binding driver into prefix and continuation operations while preserving task
+order, containers, accounting, limits and tests. Final numeric-prefix prologue
+reservations total 14,240 bytes instead of 27,272, a 13,032-byte reduction.
+This is not a complete stack bound. The unchanged control passes the final
+full suite and three additional fresh processes with no stack override.
+The older separate full-pipeline setup overflow has not been rerun or relabeled.
+
+[Runtime review](RUNTIME-REVIEW.md) verifies 555 declared inputs against immutable
+Git and raw disk bytes, exact launchers, baseline records, logs and the final
+42,402,816-byte test artifact, SHA256
+`29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446`.
+The initial artifact is identified by its own receipt and retained locally;
+neither executable is included in this evidence archive.
+
+[evidence.zip](evidence.zip) contains **65 members, 479,039 bytes**, SHA256
+`8d46b31379d75567b195b639cb3bc289ad1c9d26df53d29dbfd99ba22e38c5b9`.
+[manifest.json](manifest.json) pins each member.
+
+The archive preserves initial and final gates, exact launchers, three control
+rechecks, debugger/prologue observations, baseline records, source patches,
+contract snapshots and reviews. Seven readable review/checker files are exact
+archive mirrors. Toolchain version text is an earlier unchanged capture.
+The independent package readback is [recorded separately](PACKAGE-READBACK.md).
+
+Reproduce from the identified source with the project Windows toolchain, one
+compiler job, `CARGO_INCREMENTAL=0`, and no lifecycle or RUST_MIN_STACK override:
+
+```text
+cargo test --locked --offline -p oa-core --lib -- --list
+cargo test --locked --offline -p oa-core --lib emission -- --test-threads=1
+cargo test --locked --offline -p oa-core --lib -- --test-threads=1
+cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings
+cargo fmt --all -- --check
+```
+
+Helpers retain the producing machine's layout and must be read before reuse.
+The [readback checker](inspect_runtime.py) validates evidence without launching
+Cargo or the binary. Receipts bind declared inputs and recorded environment,
+not exhaustive machine state or authenticated build provenance. Debugger exit
+zero after killing the stopped process is not a passing test. Archived diagnostic
+helpers are recipes; their corresponding receipts identify actual executions.
+
+Actual-output parse/resolve/admission, complete Project equality under justified
+scratch bounds, stronger parser producer timing and an owning accepted result
+remain required. Original expression counts alone do not bound arbitrary faulty
+output. This branch-specific prerequisite is separate from the published preview;
+live coordination and broader acceptance remain in issue #7.
@@ -0,0 +1,35 @@
+# Independent emission runtime readback
+
+Final source: `8d52dab97c92cc31baae9f20d8c324b55818aa5d`. The completed focused run passes11 new tests; full oa-core library execution completes253pass/16 inherited failures, listing269 names. Strict oa-core all-target Clippy exits0. Format exits1 with unchanged baseline bytes. This is not a green full-suite/format claim or accepted-output authority.
+
+Reviewed and executed only the prepared read-only `inspect_runtime.py`, after parent confirmed all five gates complete, using bundled Python `-I -B` with final source, `8d52dab`, `11`. No Cargo, product binary, test executable, debugger or repeated-control launcher was run by this reviewer. The checker was unchanged from its prepared SHA-256 `aec366f529b9c8466316a304bcc7ca6688863be2b8da88f03d94cb6a8114019b`.
+
+## Final evidence reconciliation
+
+- `EMISSION-RUNTIME-READBACK.json`:5930 bytes, SHA-256 `c9d4abb060a34e862769c4a6428da560cb5bb4f6daf82b57d1ad5ff828b9b55e`. It records each exact command, source/receipt/log/manifest/launcher pin and the11 added test names.
+- All555 declared inputs match immutable Git blobs and current raw disk bytes; final HEAD matches and tracked tree is clean. All five manifests are identical at SHA-256 `42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50`. All receipts report unchanged inputs and no verification failures.
+- Focused/full/list identify the same actual test executable:42,402,816 bytes, SHA-256 `29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446`. Current bytes, actual logged Running paths and receipt identities agree.
+- Every final launcher matches before/after SHA-256 `7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401`. Independently compared its complete source with the previously reviewed carried launcher: only source pin/message and output directory changed. Actual command status propagates; changed source/helper checks remain intact.
+- Recorded environment matches the prior carried environment exactly: one compiler job, incremental0, isolated target/toolchain directories, absent RUSTFLAGS/RUSTC/RUSTUP_TOOLCHAIN and absent RUST_MIN_STACK/ARCADIA_CODEC_LIFECYCLE_PHASE. This is declared-source and recorded-environment reconciliation, not universal toolchain/RSS provenance.
+- All258 prior outcomes match by exact name/status. Focused names equal exactly the11 added successful names; full and listing name sets match with no duplicates. The16 failure blocks are byte-identical after replacing only numeric thread PID; this checker does not normalize line endings, trim whitespace or rewrite locations/messages. Format bytes match exactly: `c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d`.
+- Baseline full/list/fmt raw logs and receipts match members of published carried evidence ZIP pinned to SHA-256 `2eca143b706458c1c0217af715fa6f17c01a0b9f85a5313d6a231dabe1aba7c9`. No editable baseline summary substitutes for those bytes.
+
+## Initial failure remains failed
+
+Initial source `19a4082117b88caf332198e4c685bde91005cb52` focused run passed11, raw SHA-256 `96158d78a50b54963dcd39f1a2e642671cf78bdfa97c995979c71541e7cabdb5`. Its full run completed only135 outcome rows, then aborted at the existing ordinary-index small-stack control with3221225725/0xc00000fd. Raw SHA-256 `7a23c1151cfba02f6527bef6c8ffd53ffa5eac0e0598e37728733bc85230e538`. It is not a normal completed16-failure result. Both original manifests pin `7f025170115bdf4884b00af20019565c9d214713d5a8f8fc9d78d3c819db4d00`; recorded input checks are clean.
+
+The preserved initial binary is42,402,816 bytes with SHA-256 `777457cfefb8a3046e3f0809cabd936cfb742abe792befad2c50e05dfac1bf6b`, verified directly from `artifacts/19a4082-oa_core.exe`. Equal length does not imply identity with the repaired binary.
+
+Debugger raw SHA-256 `fca0fc9a3c59b95beb84d1690df6f0b289dcc46bd949337de555f7102b2cce59` matches its receipt and shows0xc00000fd with Exact::parse_decimal/parse_literal, Cursor::exact_literal and syntax::binding active. Debugger process exit0 is not a test pass. The initial source's worker/parse_impl/parse_with_profile/parse/accepted/indexed prologue reservations match the preserved prior-fa7 records exactly; attributing this recurrence to growth in those frames is unsupported.
+
+## Repair and repeated-control scope
+
+The final code delta from19a4082 changes syntax.rs and the repair note only; emission source/tests remain unchanged. Independent source-review ownership for the parser extraction remains separate from this runtime audit.
+
+Static prologue observations: initial binding reserves0x6a88=27,272 bytes. Final binding reserves0x9d8=2,520; prefix reserves0x2dc8=11,720, so their jointly active prefix/numeric branch reserves14,240, a13,032-byte reduction in those recorded frames. Continuation reserves0x3468=13,416; binding plus continuation totals15,936. Prefix and continuation must not be added together as simultaneously active frames. Other recorded numeric, unit and parse_typed prologues are unchanged. These are static reservations, not measured total runtime stack use or a universal native-stack proof.
+
+Read `repeat_stack_control.py` before inspecting its results; did not run it. All three recorded fresh subprocess invocations target exactly the unchanged `language::analysis_source::mixed::project::ordinary_index::tests::small_stack_success_and_late_header_failure_leave_no_partial_owner` with `--exact --test-threads=1`. Each raw log contains one pass, zero failures/ignores and268filtered; exit0. Each log hash and helper hash matches its receipt, and all three name the final focused artifact/source. The recipe checks clean source and absent stack override, stops on any failed attempt rather than retrying until pass, and verifies the artifact hash before/after the loop. These are three observed successful controls in this environment, not guarantees across arbitrary layouts/platforms.
+
+The final completed full run also preserves every prior successful control by exact outcome matching. No test expectation was relaxed to turn the aborted original full run into acceptance. Existing16 failures, format failure and initial crash/debugger records remain part of the deliverable.
+
+The reviewed result supports the private unverified-emission prerequisite and the separately reviewed parser frame repair. It does not establish actual-output parse/resolve/equality verification, before-allocation completeness, public mixed editing, persistence/history adoption, a merged follow-up branch or a new release.
@@ -0,0 +1,32 @@
+# Independent emitted-unverified production review
+
+2026-09-25. **No concrete source correctness blocker found; compiler and runtime acceptance pending.** Reviewed frozen uncommitted production over `fa7a980418ef99d772e67c66c28dfa7b5181f875` against selected contract `harness/analysis-mixed-emission-contract-20260925.md`, SHA256 `2bb0f15ee6a97ca88bc3bfa55e7ae8c830ce389ed05aee879465cd66977cd701` (published6c0d9e80). Tests were still being authored and are not part of this verdict. No source edits, Cargo, executable or network actions.
+
+Exact working bytes, under `crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/`:
+
+| File | SHA256 |
+| --- | --- |
+| `rename/emission.rs` | `62a7252b24deaabec1b4a73d45330155e21e1f03c16c3c6baf1bedc3063289e7` |
+| `rename.rs` | `01a7955fb6daa3c1a16032db8508dc1222b4052d2bc533bf4607fb0750d5b8f1` |
+
+The existing file changes only its module description and emission child wiring. Existing planner validation/sizing behavior and carried production files are unchanged.
+
+## Findings
+
+- **Sealed authority and branches (`emission.rs:16–45`):** both consuming methods compare the complete current bundle, rerun the existing complete edit validator (which includes size validation), and enforce the selected branch. No-op returns the original source field; empty validated plan maps drop without output construction. Changed emission rejects every Some carried guard, including borrowed-zero mode, before O reservation. This avoids discarding a reservation for a still-live external retained owner.
+- **Upfront aggregate reservation (`:46–54,139–151`):** complete S comes from the original-coordinate size walk. O adds entry bytes and every canonical key with checked addition, uses complete F and zero lower occurrences, and is reserved against the existing source ledger already containing R+M. No output String, path key, entry string or map entry is created before this reservation. Original source bytes and desired aliases remain borrowed. No lengths map, copied edit list, extra complete buffer or heap wrapper was added.
+- **Original-coordinate emission (`:56–108`):** canonical source files each get one final String; their sorted physical-key range is walked for checked size and then original-slice construction. Original untouched ranges, exact desired alias and final suffix are appended in order. The existing validator authenticates target membership, UTF-8 boundaries and nonoverlap before map indexing; immutable plan/desired authority means the later `names[target]` indexing has a proved key. `.get` guards range/tail slicing. Replacement strings and markers are not globally substituted or decoded. Untouched files still copy once.
+- **Completeness and consistency (`:99–115`):** each constructed length equals its independent size calculation; checked produced sum and complete map count must equal S/F. Entry is copied once and reserved separately from its equal-spelled map key. Canonical path uniqueness is inherited from the sealed syntax/traversal; the final count also refuses a duplicate-key construction discrepancy. These are producer checks, not semantic output authentication.
+- **Ownership transfer (`:116–136`):** exact Limits and ProjectLimits, original expression count E and desired borrow are captured without model/name clones. Explicit names/edit/source drops happen before Pending construction. All old auxiliary maps, warnings, syntax, model and ledger belong to the dropped source; external original source and desired remain caller-owned under the declared exclusions. Changed legacy-only admission ensures no counted external carried owner is silently discarded. Pending retains exactly O, not the temporary L+O overlap.
+- **Lifetime/API separation (`:6–34`):** Pending has only the desired lifetime, owns its output and has private fields with no production getters/extraction/adoption/parser conversion. Unchanged returns only the original-source lifetime. There is no common large owning enum, Box/Rc/Arc, callback layer, general loose-parts constructor or duplication of policy inside old witness types. Actual Rust lifetime/type checking remains a compiler gate.
+- **Failure lifecycle:** existing source-bound diagnostic conversion runs while self remains alive. Aggregate failures use explicit entry/default fallback; per-file construction failures use the actual canonical file. Partial output and the consumed plan drop on refusal, with no reusable reservation or pending result. Failure-diagnostic allocations retain the existing documented reporting exception. Runtime tests must still demonstrate intended phases and locations.
+
+No blocker or requested production repair arose in this frozen source pass. The split API avoids the specific large-outcome shape discussed in design; it does not prove debug stack-frame behavior. Retain all old small-stack source/allowances and exercise the new emission/drop path after preparing parse prerequisites outside its worker. Do not infer safety from source-size estimates or weaken existing controls.
+
+## Pending acceptance and limits
+
+Test review must independently confirm E/H exact L+O cap pairs, complete OA/SA/global/scoped/category/Unicode/CRLF bytes, untouched-file copies, stale/wrong-branch/corrupt-map refusal, any-carried rejection with guarded no-op preservation, exact policy/E/desired retention and lifetime separation. Existing repeated sizing is allowed and does not charge parsing/numeric Usage. The original E scalar is preserved provenance, not yet a justified bound on arbitrary faulty reparsed operands. Neither this source review nor a future passing emission test accepts rewritten source, invokes carried parsing, closes parser before-growth obligations, or enables public source8/history/save.
+
+## Committed readback
+
+Commit `19a4082117b88caf332198e4c685bde91005cb52` matches both production file hashes above exactly. The final test files are bound separately in TEST-REVIEW.md. No production repair was needed during source review; the two resolved test-fixture corrections and scoped stack extension do not alter production. This is a source/hash readback, not runtime acceptance.
@@ -0,0 +1,70 @@
+# Emission checkpoint stack investigation
+
+2026-09-25. Source `19a4082117b88caf332198e4c685bde91005cb52` compiled and
+passed all eleven new emission tests, including the seven scoped 128 KiB
+success/no-op/refusal/deep/wide worker cases. Its full library run then aborted
+with STATUS_STACK_OVERFLOW (3221225725) in the unchanged ordinary-index
+`small_stack_success_and_late_header_failure_leave_no_partial_owner` control.
+There were 135 completed passing outcomes before abort. This is not the completed
+sixteen-failure baseline.
+
+The exact artifact is 42,402,816 bytes, SHA256
+`777457cfefb8a3046e3f0809cabd936cfb742abe792befad2c50e05dfac1bf6b`.
+It was copied locally before replacement, under the gates folder's artifacts
+directory; it is identified rather than included in the evidence ZIP.
+The initial full log SHA256 is
+`7a23c1151cfba02f6527bef6c8ffd53ffa5eac0e0598e37728733bc85230e538`.
+
+LLDB reproduced the failure in Windows heap allocation beneath String formatting,
+Exact::parse_decimal, Budget::exact, Cursor::exact_literal, syntax::binding,
+declarations::parse, State::parse_typed, Parser::unit and parse_impl. No emission
+method is on this active stack. The worker is in its initial rich-source parsing
+path. Debugger log SHA256:
+`fca0fc9a3c59b95beb84d1690df6f0b289dcc46bd949337de555f7102b2cce59`.
+The stopped child PID 3724 was explicitly killed. Debugger exit zero reports
+that controlled observation, not a passed test; no child remains running.
+
+Symbol-bound prologue records show these selected frames are identical to the
+previous passing fa7 artifact: parse_impl 11,048 bytes, parse_with_profile 200,
+parse 280, accepted 1,432, indexed 1,496 and the actual worker 6,920. The separate
+same-named test shim is 56. The new emitter does not add fields to old owners or
+change those parser/test sources. Thus the prior duplicated-policy explanation
+does not apply to this recurrence. This observation does not establish the full
+cause of process/layout/heap-dependent stack headroom variation.
+
+Additional active-frame observations identify binding at 27,272 bytes,
+declarations::parse at 22,664, Parser::unit at 11,864, State::parse_typed at
+6,952, Exact::parse_decimal at 2,296, parse_literal at 952, Budget::exact at
+632 and Cursor::exact_literal at 776. Prologues are not complete live-stack
+measurements; calls, OS/library frames and padding remain outside this list.
+
+The selected repair separates the existing iterative binding driver from its
+prefix and continuation operations. Numeric prefix parsing should no longer
+carry stack slots for unrelated continuation construction. It preserves the
+same task/value vectors, processing order, accounting and policies. No numeric
+formatting change, larger stack, heap wrapper, optimizer attribute or weakened
+test is selected. Independent mechanical source review and measured rebuilt
+prologues plus the unchanged runtime controls are required before acceptance.
+
+Repair source is `8d52dab97c92cc31baae9f20d8c324b55818aa5d`. Independent
+mechanical review confirms the continuation operations are token-identical and
+the prefix operations differ only by two optional trailing argument commas.
+The compiled binding driver reserves 2,520 bytes and its active prefix helper
+11,720: 14,240 bytes together versus the former 27,272, a 13,032-byte reduction
+in these selected prologue reservations. The mutually exclusive continuation
+helper reserves 13,416 bytes (15,936 with the driver); it must not be added to
+the active numeric-prefix sum. Other observed frames retain their prior sizes.
+These figures exclude call overhead and are not a complete live-stack bound.
+
+The final artifact is 42,402,816 bytes, SHA256
+`29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446`.
+All eleven focused tests pass. The full run completes with 253 passed and 16
+failed; exact baseline reconciliation is recorded in RUNTIME-REVIEW.md.
+The unchanged previously overflowing control also passes three fresh processes,
+with no stack override or test edits. Their separate receipts preserve all
+attempts. Strict core all-target Clippy passes; formatting output remains the
+inherited eight blocks in five files. The evidence supports this bounded repair,
+not universal stack safety or an explanation of all process headroom variation.
+
+The older rename full-pipeline setup observation remains separate; this work
+does not retroactively turn an unrerun historical fixture into a pass.
@@ -0,0 +1,18 @@
+# Independent mechanical parser stack repair review
+
+2026-09-25. No source blocker found. Reviewed the frozen working change against `19a4082117b88caf332198e4c685bde91005cb52`, then confirmed the same bytes at committed `8d52dab97c92cc31baae9f20d8c324b55818aa5d` with a clean worktree. This is source review; compiler, native-frame measurements and runtime acceptance belong to the parent.
+
+| Reviewed file in `.local/as3batch` | SHA256 |
+| --- | --- |
+| `crates/oa-core/src/language/analysis_source/syntax.rs` | `2763738ab9ada418ca8d05b424035bba552606338234308288d5a373bcbad439` |
+| `harness/analysis-mixed-parser-stack-repair-20260925.md` | `e2156601e6747ff18e92034827acf4a72035a1fa77f3ff7618c04f1ce64a0f12` |
+
+The driver at `syntax.rs:31` retains its initial active check, unbound fast path, original task/value Vecs, pop followed by the per-task active check, and final value extraction. Only dispatch changes: expression tasks call `prefix` (`:53`); other tasks call `continue_task` (`:154`). Neither helper calls the driver or the other helper. Both borrow the existing Cursor and Vecs; the continuation takes ownership of the same popped task. No new collection, clone, policy field, allocation, budget check, forwarding wrapper or recursive parser operation is introduced.
+
+Independent source comparison, preserving quoted strings and removing formatting whitespace, established that the prefix body is unchanged except two optional trailing argument commas removed by formatting. Every continuation arm is token-identical (2,622 comparison tokens). Code before binding and after the extracted continuation is unchanged. Manual control-flow review covers Continue, Binary, Unary, Group, Next, Collected, Power and AsKind: cursor mutations, task/value push and pop order, precedence, sequence limits, duplicate keys, reference charges, numeric validation, spans, open/close depth, node construction and error order are retained. The added Expression unreachable arm is excluded by the driver's preceding exhaustive Expression dispatch; there is no other caller.
+
+Moved `return Err` paths now return from a helper and immediately propagate through the driver's `?`. The driver still owns and drops its two stacks on failure; helper-owned popped payloads retain their original move/drop roles. This changes native frame layout and cleanup call paths, so source equivalence does not establish a stack bound. Parent measurements must compare the active driver-plus-prefix and driver-plus-continuation combinations, and unchanged stack controls must exercise actual behavior. No test, fixture or allowance was changed by this repair.
+
+The preserved 19a4082 full run aborted with `0xc00000fd`; the exact artifact was 42,402,816 bytes, SHA256 `777457cfefb8a3046e3f0809cabd936cfb742abe792befad2c50e05dfac1bf6b`. The inspected debugger record shows Exact decimal formatting beneath binding/declarations/typed parsing; no emitter call is active. Earlier outer-frame reservations matching fa7 and unchanged existing owner fields do not support calling this a duplicate-policy regression. The repair note accurately distinguishes partial measured prologues from total stack use and a killed debugger process from a test pass. The original source/test reviews and failed attempt remain preserved.
+
+Review tools were Git diff/show/status, file hashing and a source-text comparison script only. No Cargo, executable tests, source edits or network operations were performed by this reviewer. Runtime results, even if available separately, are not claimed by this report.
@@ -0,0 +1,41 @@
+# Independent emitted-unverified test review
+
+2026-09-25. **Ready for compiler/runtime gates after two pre-execution fixture corrections; no remaining source-review blocker found.** Reviewed frozen uncommitted tests over `fa7a980418ef99d772e67c66c28dfa7b5181f875`, selected contract SHA256 `2bb0f15ee6a97ca88bc3bfa55e7ae8c830ce389ed05aee879465cd66977cd701`, and independent `EMISSION-ORACLE.md` SHA256 `d825345060bf3ef9b1388c59f3804d190e2de8f68b0f4c3c24caae05a9acaea5`. No Cargo or application execution. Literal byte inspection is not a reported parser/emitter pass.
+
+Paths under `crates/oa-core/src/language/analysis_source/mixed/`:
+
+| Frozen file | SHA256 |
+| --- | --- |
+| `project/ordinary_index/rename/emission/tests.rs` | `a31471c4afff4326e72360d838a970baf2a6a5964a478e6641850c6ba6511e57` |
+| `carried/tests.rs` | `0bc222783bf55e30917932f169891ebcd16d9e202abfeda67fb3a33d66ec7bb8` |
+
+Ten new tests live in the emission module; one appended carried test is named `emission_refuses_changed_carried_even_zero_and_preserves_noop_guards`. A focused `emission` substring includes all eleven, whereas filtering only the emission module would omit the guard control. Existing ordinary-index and rename test files are unchanged from fa7; the carried file only appends the new control. Production remains the reviewed hashes in SOURCE-REVIEW.md.
+
+## Resolved pre-execution findings
+
+1. Initial test SHA256 `259ada3b0bf5e1e8e01d6202a9625760ce8fb78f390e9010f3e083db114183e8` gave the policy/lifetime fixture private bytes2048/references31 but caller bytes2000/references29. Existing parse_with_profile rejects that widening before emission. Reported directly; repaired caller values are bytes3000/references37, preserving distinct all-field comparisons and the original private profile. No admitted Budget was mutated and no production rule was relaxed.
+2. Initial category expected output converted every LF to CRLF, but the unchanged original fixture contains mixed newlines: only two CR bytes and thirty LF bytes. Independent literal comparison against the existing 36-row physical oracle failed. Implementer independently identified the same issue and repaired only the expected literal's comment boundary and final newline. The original fixture, numeric edit tuples and output-size expectation remain unchanged. Final expected output equals all 36 independent original-coordinate replacements byte-for-byte: 2145 bytes, SHA256 `120daee4fcb5f524e071cf8793d0f0c7d174c448bd69b0cba2fd4022a8ffb3e3`. Original fixture SHA256 remains `3943579866157c7b5d95ce9edcb2d643058826b9af44257557e2864f130d15fc` (2152 bytes).
+
+These are source-review fixture corrections, not failed Rust runs. Their initial incorrect expectations are recorded here rather than presented as successful evidence.
+
+## Oracle fidelity and coverage
+
+- **Real overlap boundaries:** E and H construct policy before actual parse/resolve/index/plan. The tests assert L=(16,0,9) and (26,0,33), then exercise exact entries/text caps17/114 and29/216, lowering one coordinate independently. Output O=(1,0,105)/(3,0,183), whole file maps, desired pointer, E0 and exact policy are asserted. Predecessor unwraps ensure a late-boundary claim cannot silently pass because an earlier phase rejected. Failures require entry/default location; production/source reasoning identifies the upfront reservation as the only remaining cap check.
+- **No-op identity/lifetime:** E caps16/78 and H26/132 are below output-copy overlap. Returned owner retains original bundle pointer, allocated catalog-name pointer, Slots, Usage, numeric usage and warnings. Desired is local to an inner scope and drops before the returned source is used, providing a compile-time lifetime control. Source review separately confirms the branch precedes any output allocation.
+- **Stale/wrong branch/validator:** both wrong branches refuse. Entry change, untouched/touched edits, missing/extra files and renamed path all fail complete-current validation for unchanged and changed intent. An independent equal current bundle succeeds. Missing required edit, an extra unchanged-target edit and a nonempty/range corruption control exercise existing validation before transitions; direct output_slots(usize::MAX) is explicitly arithmetic fault injection. The unchanged planner tests retain wider target/overlap/UTF-8 corruption coverage; duplicating every existing validator case is unnecessary.
+- **Policy and pending lifetime:** the repaired all-field fixture compares all six Limits values and all seven ProjectLimits/model values. Its original source bundle is local to a scope that returns Pending, proving pending cannot retain the old source lifetime. No constructor/profile mutation is used after admission. Desired remains external.
+- **Rich full bytes:** independently authored entire output files cover OA/SA global and scoped swaps, reordered/repeated call labels and cross-file references. Literal byte counts independently read back as OA213+213+474=900; Unicode/CRLF226+226+491=943; SA213+213+548=974 and226+226+565=1017. Every case asserts complete bundle equality, E15 and retained text S+42, not merely selected substrings. The expected literals do not use plan edit iteration or emitter output. Original Project and desired remain equal to their independent/reference fixtures.
+- **Four-file cross-family swap:** literal input/output maps match the oracle f↔w swap, including comments with unchanged spellings, a leading multibyte character, CRLF, references, complete untouched file, keys and entry. Output S467 plus47 key bytes plus12 entry bytes gives O=(4,0,526); E2 is asserted.
+- **Complete ordinary categories:** the repaired expected whole file covers all 36 independently authored physical edits, line-comment-separated reference trivia, implicit parent relationships, display/prose text and historical UUID exclusion. Output2145+key12+entry12 gives retained2169, F1 and E0. Exact literal comparison used the previous independently authored numeric map, not the new emitter implementation.
+- **Combined grow/shrink:** the 31-byte node alias shrinks to one byte while three occurrences of f grow to renamed_f. Independently authored complete output is924 bytes, including the unchanged b.arcadia, and O.text966. This is actual output construction under sufficient inherited text allowance; the test does not misrepresent the older930-byte source-size planning cap as sufficient simultaneous live-text capacity. The existing933-byte planning negative remains in unchanged planner tests.
+- **Carried restriction:** appended test uses both Some borrowed-zero and real retained input. Changed emission requires the exact legacy-syntax refusal at original entry0..0. No-op retains original bundle identity across another no-op plan, then a changed attempt still refuses, discriminating against losing the guard. Captured carry remains zero or the real owner count; held source bytes stay unchanged. This is not fabricated nonzero occurrence provenance.
+
+## Stack scope and pending gates
+
+The final scoped test extends the original minimal success/no-op/late-byte-refusal controls with the established 127 nested abs calls (E128) and128-item list (E129). Complete source owner, desired and plan are prepared on the normal thread. The entire plan then moves into a128KiB scoped worker, where changed output is checked/dropped or the unchanged owner is checked/dropped. Deep/wide expected bytes are authored from the fixed body with only the project alias changed; E and original bundle preservation are asserted. This exercises destruction under the new emitter frame without moving prior parser setup out of any old full-pipeline test. The new test has seven worker cases; no existing stack allowance/expected behavior was weakened.
+
+Compilation must establish privacy/borrow/lifetime correctness. Focused gates must actually include all eleven new names. Full comparison must preserve all258 prior named outcomes, sixteen inherited failure bodies, formatter disposition and existing stack controls; no completion or unchanged-runtime claim follows from this review. The independent literal checks cannot certify no arbitrary allocator failure or universal stack bound. Passing emitted-unverified tests would still not demonstrate actual-output parsing/admission/equality, accepted-result ownership, public editing or persistence.
+
+## Committed readback
+
+Commit `19a4082117b88caf332198e4c685bde91005cb52` matches both frozen test hashes above and the two production hashes in SOURCE-REVIEW.md. No test or production change occurred in this report-only readback; runtime gates remain pending. The irrelevant record-limit parenthetical was omitted from the repair narrative without changing any tested value or expectation.
@@ -0,0 +1,203 @@
+"""Read-only emission gate reconciliation. Run only after the final five gates.
+
+Usage: python -I -B inspect_runtime.py FULL_SOURCE_SHA PIN7 EXPECTED_NEW_COUNT
+Only Git read commands are executed; Cargo, launchers and binaries are never run.
+"""
+from pathlib import Path
+import hashlib
+import io
+import json
+import re
+import subprocess
+import sys
+import zipfile
+
+if sys.flags.optimize:
+    raise SystemExit('Optimized Python forbidden: verification uses assertions')
+assert len(sys.argv) == 4
+source, stem, expected_added = sys.argv[1], sys.argv[2], int(sys.argv[3])
+assert re.fullmatch(r'[0-9a-f]{40}', source)
+assert stem == source[:7]
+assert 1 <= expected_added <= 100
+base = Path(__file__).resolve().parents[2]
+root = base / '.local/as3batch'
+directory = base / '.local/analysis-mixed-emission-gates-20260925'
+prior = base / '.local/analysis-carried-phase-gates-20260925'
+destination = Path(__file__).with_name('EMISSION-RUNTIME-READBACK.json')
+assert not destination.exists(), 'Preserve prior readback; do not overwrite'
+BASELINE = 'fa7a980418ef99d772e67c66c28dfa7b5181f875'
+ARCHIVE_SHA = '2eca143b706458c1c0217af715fa6f17c01a0b9f85a5313d6a231dabe1aba7c9'
+sha = lambda raw: hashlib.sha256(raw).hexdigest()
+
+
+def git(*args):
+    return subprocess.check_output(['git', '--no-replace-objects', *args], cwd=root)
+
+
+def within(folder, relative):
+    candidate = (folder / relative).resolve()
+    assert candidate.is_relative_to(folder.resolve()), relative
+    return candidate
+
+
+def receipt(folder, name):
+    raw_receipt = (folder / (name + '.result.json')).read_bytes()
+    data = json.loads(raw_receipt)
+    raw = (folder / (name + '.log')).read_bytes()
+    assert data['log_sha256'] == sha(raw)
+    return data, raw, raw_receipt
+
+
+def outcomes(raw):
+    rows = re.findall(r'^test ([^\r\n]+) \.\.\. (ok|FAILED|ignored)\r?$', raw.decode(), re.M)
+    assert len(rows) == len(dict(rows)), 'Duplicate runtime name'
+    return rows
+
+
+def members(raw):
+    names = re.findall(r'^([^\r\n]+): test\r?$', raw.decode(), re.M)
+    assert len(names) == len(set(names)), 'Duplicate listing name'
+    return names
+
+
+def failure_blocks(raw):
+    # Preserve every byte of block whitespace/body except the numeric thread PID.
+    rows = re.findall(rb'^---- ([^\r\n]+) stdout ----\r?\n(.*?)(?=^---- |^failures:|\Z)',
+                      raw, re.M | re.S)
+    assert len(rows) == len(dict(rows)), 'Duplicate failure block'
+    return {name.decode(): re.sub(rb"(?m)^(thread '[^\r\n]*') \(\d+\) panicked",
+                                rb'\1 (<PID>) panicked', body) for name, body in rows}
+
+
+# Anchor baseline local full/list/fmt logs AND receipts to the published ZIP.
+archive_raw = (base / 'harness/experiments/analysis-carried-phase-20260925/evidence.zip').read_bytes()
+assert sha(archive_raw) == ARCHIVE_SHA
+baseline = {}
+with zipfile.ZipFile(io.BytesIO(archive_raw)) as archive:
+    names = archive.namelist()
+    assert len(names) == len(set(names))
+    for mode in ('full', 'list', 'fmt'):
+        name = f'carried-{mode}-fa7a980-1'
+        data, raw, raw_receipt = receipt(prior, name)
+        assert data['source'] == data['head_after'] == BASELINE
+        for suffix, content in [('.log', raw), ('.result.json', raw_receipt)]:
+            matches = [n for n in names if n == name + suffix or n.endswith('/' + name + suffix)]
+            assert len(matches) == 1, (name, suffix, matches)
+            assert archive.read(matches[0]) == content
+        baseline[mode] = (data, raw)
+old, old_raw = baseline['full']
+old_rows = outcomes(old_raw)
+assert old_rows == [tuple(x) for x in old['outcomes']]
+assert len(old_rows) == 258 and old['exit'] == 101
+assert sum(v == 'ok' for _, v in old_rows) == 242
+assert sum(v == 'FAILED' for _, v in old_rows) == 16
+old_out = dict(old_rows)
+old_listing = members(baseline['list'][1])
+assert old_listing == baseline['list'][0]['listing_members']
+assert baseline['list'][0]['exit'] == 0 and set(old_listing) == set(old_out)
+assert baseline['fmt'][0]['exit'] == 1
+
+assert git('rev-parse', 'HEAD').decode().strip() == source
+assert not git('status', '--porcelain', '--untracked-files=no').strip()
+scope = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo', 'build', 'crates',
+         'assets', 'docs', 'examples', 'harness/fixtures', 'vendor']
+paths = git('ls-tree', '-r', '--name-only', source, *scope).decode().splitlines()
+blobs = subprocess.check_output(['git', '--no-replace-objects', 'cat-file', '--batch'], cwd=root,
+    input=''.join(f'{source}:{p}\n' for p in paths).encode())
+offset, expected_inputs = 0, []
+for path in paths:
+    end = blobs.index(b'\n', offset)
+    _, kind, count = blobs[offset:end].split()
+    count = int(count)
+    raw = blobs[end + 1:end + 1 + count]
+    assert kind == b'blob' and within(root, path).read_bytes() == raw, path
+    expected_inputs.append({'path': path, 'bytes': count, 'sha256': sha(raw)})
+    offset = end + count + 2
+assert offset == len(blobs)
+
+prefix = ['cargo', 'test', '--locked', '--offline', '-p', 'oa-core', '--lib']
+commands = {
+    'focused': prefix + ['emission', '--', '--test-threads=1'],
+    'full': prefix + ['--', '--test-threads=1'],
+    'list': prefix + ['--', '--list'],
+    'clippy': ['cargo', 'clippy', '--locked', '--offline', '-p', 'oa-core', '--all-targets', '--', '-D', 'warnings'],
+    'fmt': ['cargo', 'fmt', '--all', '--', '--check'],
+}
+expected_env = baseline['full'][0]['environment']
+assert expected_env['CARGO_BUILD_JOBS'] == '1' and expected_env['CARGO_INCREMENTAL'] == '0'
+for key in ('RUSTFLAGS', 'RUSTC', 'RUSTUP_TOOLCHAIN', 'ARCADIA_CODEC_LIFECYCLE_PHASE', 'RUST_MIN_STACK'):
+    assert expected_env[key] is None
+verified, all_receipts, raw_logs = {}, {}, {}
+artifact_identity = launcher_identity = None
+for mode, command in commands.items():
+    name = f'emission-{mode}-{stem}-1'
+    data, raw, receipt_raw = receipt(directory, name)
+    assert data['source'] == data['head_after'] == source
+    assert data['mode'] == mode and data['command'] == command
+    assert data['invocation'] == 'cargo' and data['test_target'] is None
+    assert data['filter'] == ('emission' if mode == 'focused' else '')
+    assert not data['changed_inputs'] and not data['verification_failures']
+    assert data['cwd'] == str(root) and data['environment'] == expected_env
+    manifest_raw = within(directory, data['inputs']).read_bytes()
+    assert sha(manifest_raw) == data['inputs_sha256']
+    assert json.loads(manifest_raw) == {'source': source, 'inputs': expected_inputs}
+    launcher = within(directory, data['launcher_copy']).read_bytes()
+    assert sha(launcher) == data['launcher_sha256'] == data['launcher_sha256_after']
+    assert source.encode() in launcher
+    if launcher_identity is None:
+        launcher_identity = sha(launcher)
+    assert sha(launcher) == launcher_identity, 'Unexpected mixed launchers: review explicitly'
+    rows = outcomes(raw)
+    assert rows == [tuple(x) for x in data['outcomes']]
+    listing = members(raw) if mode == 'list' else []
+    assert listing == data['listing_members'] and len(listing) == data['listing_count']
+    if mode in ('focused', 'full'):
+        counts = tuple(sum(v == state for _, v in rows) for state in ('ok', 'FAILED', 'ignored'))
+        summary = re.findall(r'^test result: (ok|FAILED)\. (\d+) passed; (\d+) failed; (\d+) ignored; 0 measured; (\d+) filtered out;', raw.decode(), re.M)
+        assert len(summary) == 1 and tuple(map(int, summary[0][1:4])) == counts
+        assert summary[0][0] == ('FAILED' if counts[1] else 'ok')
+        assert int(summary[0][4]) == (258 if mode == 'focused' else 0)
+    else:
+        assert not rows
+    assert data['exit'] == {'focused': 0, 'full': 101, 'list': 0, 'clippy': 0, 'fmt': 1}[mode]
+    assert len(data['artifacts']) == (1 if mode in ('focused', 'full', 'list') else 0)
+    for artifact in data['artifacts']:
+        path = Path(artifact['path'])
+        assert path.resolve().is_relative_to(Path(expected_env['CARGO_TARGET_DIR']).resolve())
+        actual = path.read_bytes()
+        assert len(actual) == artifact['bytes'] and sha(actual) == artifact['sha256']
+        assert str(path).replace('\\', '/') in raw.decode().replace('\\', '/')
+        if artifact_identity is None:
+            artifact_identity = artifact
+        assert artifact == artifact_identity, 'Test/list artifact mismatch'
+    all_receipts[mode], raw_logs[mode] = data, raw
+    verified[name] = {'source': source, 'exit': data['exit'], 'outcomes': len(rows),
+        'listing': len(listing), 'log_sha256': sha(raw), 'result_sha256': sha(receipt_raw),
+        'inputs_sha256': sha(manifest_raw), 'launcher_sha256': sha(launcher)}
+
+new_out = dict(all_receipts['full']['outcomes'])
+assert len(new_out) == 258 + expected_added
+assert all(new_out.get(k) == v for k, v in old_out.items())
+added = set(new_out) - set(old_out)
+assert len(added) == expected_added
+assert all(new_out[k] == 'ok' and 'emission' in k for k in added)
+assert set(dict(all_receipts['focused']['outcomes'])) == added
+assert all(status == 'ok' for _, status in all_receipts['focused']['outcomes'])
+assert set(all_receipts['list']['listing_members']) == set(new_out)
+old_blocks, new_blocks = failure_blocks(old_raw), failure_blocks(raw_logs['full'])
+assert len(old_blocks) == len(new_blocks) == 16
+assert set(old_blocks) == {k for k, v in old_out.items() if v == 'FAILED'}
+assert old_blocks == new_blocks, 'Failure bodies differ beyond thread PID'
+assert raw_logs['fmt'] == baseline['fmt'][1]
+
+result = {'source': source, 'baseline': BASELINE, 'baseline_archive_sha256': ARCHIVE_SHA,
+    'checker_sha256': sha(Path(__file__).read_bytes()), 'inputs': len(expected_inputs),
+    'unchanged_old_outcomes': 258, 'added_passed': expected_added, 'added_names': sorted(added),
+    'full_passed': sum(v == 'ok' for v in new_out.values()), 'full_failed': 16,
+    'identical_failure_blocks_after_pid_only_normalization': 16,
+    'identical_fmt_sha256': sha(raw_logs['fmt']), 'artifact': artifact_identity,
+    'environment': expected_env, 'receipts': verified,
+    'scope': 'Committed declared inputs, pinned baseline archive, raw logs and current artifact bytes; no Cargo/executable execution. Launcher semantics require independent source review.'}
+with destination.open('x', encoding='utf-8', newline='\n') as stream:
+    stream.write(json.dumps(result, indent=2) + '\n')
+print(json.dumps(result, indent=2))
@@ -0,0 +1,271 @@
+{
+  "source": "8d52dab97c92cc31baae9f20d8c324b55818aa5d",
+  "scope": "Private unverified output only; no accepted editing or parser timing claim. Full library and formatter retain documented baseline failures.",
+  "archive": {
+    "file": "evidence.zip",
+    "bytes": 479039,
+    "sha256": "8d46b31379d75567b195b639cb3bc289ad1c9d26df53d29dbfd99ba22e38c5b9"
+  },
+  "members": {
+    "baseline/carried-fmt-fa7a980-1.inputs.json": {
+      "bytes": 103383,
+      "sha256": "b51682b333d96d91167f4da8e4f8e4f4b1d443fbfc875fead918d0db1e1db203"
+    },
+    "baseline/carried-fmt-fa7a980-1.log": {
+      "bytes": 6446,
+      "sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d"
+    },
+    "baseline/carried-fmt-fa7a980-1.result.json": {
+      "bytes": 1882,
+      "sha256": "ad79d2092b8182f3df68ed383f7ad32b3fa48afb029fa13da1ca0463203fa213"
+    },
+    "baseline/carried-full-fa7a980-1.inputs.json": {
+      "bytes": 103383,
+      "sha256": "b51682b333d96d91167f4da8e4f8e4f4b1d443fbfc875fead918d0db1e1db203"
+    },
+    "baseline/carried-full-fa7a980-1.log": {
+      "bytes": 42536,
+      "sha256": "26b946c38db53e7dc589771e1829908dff3596cbf947ecce2442d1bf1d1896af"
+    },
+    "baseline/carried-full-fa7a980-1.result.json": {
+      "bytes": 38113,
+      "sha256": "6b6ec7a335e8c1d03ec5c584e3fe8b444839e27cf3afb9f84bced33c73563743"
+    },
+    "baseline/carried-list-fa7a980-1.inputs.json": {
+      "bytes": 103383,
+      "sha256": "b51682b333d96d91167f4da8e4f8e4f4b1d443fbfc875fead918d0db1e1db203"
+    },
+    "baseline/carried-list-fa7a980-1.log": {
+      "bytes": 29100,
+      "sha256": "ee1c0a5367f277720407fb30a33ccdaef68b58fed3c578caceffbae7ef4035c4"
+    },
+    "baseline/carried-list-fa7a980-1.result.json": {
+      "bytes": 31333,
+      "sha256": "8f739ce87c1a700bc9a51ea70b7dd8d3f77267123d5883f3cd8a36cc2a4e2c01"
+    },
+    "baseline/launchers/51f590750896843210e02df971c7396bf379494e1605bd059ef017e6e4d41ec5.py": {
+      "bytes": 7661,
+      "sha256": "51f590750896843210e02df971c7396bf379494e1605bd059ef017e6e4d41ec5"
+    },
+    "contracts/EMISSION-CONTRACT-REVIEW.md": {
+      "bytes": 6836,
+      "sha256": "5a6e0d5a534b8a04303beb487aa2107d4403d8b8a4ef836f8ff7cb0841d9c759"
+    },
+    "contracts/EMISSION-ORACLE.md": {
+      "bytes": 11222,
+      "sha256": "d825345060bf3ef9b1388c59f3804d190e2de8f68b0f4c3c24caae05a9acaea5"
+    },
+    "contracts/EMISSION-TRANSITION-PROPOSAL.md": {
+      "bytes": 16372,
+      "sha256": "802490f7124fcd73e12d12dc445d82a3579a3d34b67fe91f98687170f7b2f69d"
+    },
+    "contracts/analysis-mixed-emission-contract-20260925.md": {
+      "bytes": 8282,
+      "sha256": "2bb0f15ee6a97ca88bc3bfa55e7ae8c830ce389ed05aee879465cd66977cd701"
+    },
+    "diagnostics/debug_stack_19a4082.py": {
+      "bytes": 1738,
+      "sha256": "554d1eff628cf43cb87d710fb7efed0f265e47dab06d85802ba3dbd1f421986b"
+    },
+    "diagnostics/emission-debugger-19a4082-1.log": {
+      "bytes": 12681,
+      "sha256": "fca0fc9a3c59b95beb84d1690df6f0b289dcc46bd949337de555f7102b2cce59"
+    },
+    "diagnostics/emission-debugger-19a4082-1.result.json": {
+      "bytes": 1245,
+      "sha256": "8eb73bb3bdd242a3e9a8c22d8088eb4c9825a3b1e7619336a85fdf52eb7fcc06"
+    },
+    "diagnostics/emission-focused-8d52dab-1.active-frames.json": {
+      "bytes": 15060,
+      "sha256": "b62be9f286aa7960fcf65fd203554eeab165ed02c9e4c090ca3279bb1c8451c6"
+    },
+    "diagnostics/emission-full-19a4082-1.active-frames.json": {
+      "bytes": 12196,
+      "sha256": "f50003979ac30a3d2c8e82a169018fbee213fc75ef545d8f753bee0e3607bcc2"
+    },
+    "diagnostics/emission-full-19a4082-1.stack-frames.json": {
+      "bytes": 13090,
+      "sha256": "1b12420a2792c8c4a7f6fb46dbc7b0a6e7eedc169bed17b0a35f403d0d9b2b58"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-1.log": {
+      "bytes": 259,
+      "sha256": "0811d6b37734d83d3c75d3668f3e75bb481b14385d021114e5bb5a07fb1724a3"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-1.result.json": {
+      "bytes": 1410,
+      "sha256": "c7ea0e123a741a7fb1f62f4cea596f9949b9793711f2dc943603271379b3fc7e"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-2.log": {
+      "bytes": 259,
+      "sha256": "0811d6b37734d83d3c75d3668f3e75bb481b14385d021114e5bb5a07fb1724a3"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-2.result.json": {
+      "bytes": 1409,
+      "sha256": "42664800e4cf3f8d955b4a9a64a0d72a167ff0c1d161083aab33cb9bb006aeed"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-3.log": {
+      "bytes": 259,
+      "sha256": "0811d6b37734d83d3c75d3668f3e75bb481b14385d021114e5bb5a07fb1724a3"
+    },
+    "diagnostics/emission-stack-repeat-8d52dab-3.result.json": {
+      "bytes": 1410,
+      "sha256": "1c74821cdce94668550f12130990248e4dd3238fcaf993c886278aa5b4da5b92"
+    },
+    "diagnostics/inspect_active_frames.py": {
+      "bytes": 2119,
+      "sha256": "1d75532e93027099ff82480a5c174db15446e2a5be1f993977698a5e1d7622bb"
+    },
+    "diagnostics/inspect_repaired_active_frames.py": {
+      "bytes": 2236,
+      "sha256": "684dfbbebe3cf3d5deeefd7792ef4a3c205c166390c171da48acefc8d1ee9428"
+    },
+    "diagnostics/inspect_stack_frames.py": {
+      "bytes": 1889,
+      "sha256": "80372b64f336b73570c1ee790c41646d0d7765e781d3489a4aa682b07515a1a6"
+    },
+    "diagnostics/prior-fa7.stack-frames.json": {
+      "bytes": 13090,
+      "sha256": "09a30cf7a1e0f19b9c9ad8757304168f133a748e817b887e5f2fe2d33bc918f3"
+    },
+    "diagnostics/repeat_stack_control.py": {
+      "bytes": 2757,
+      "sha256": "b50ac80e9117f97f41aa5d76d96e25fc2fd52edbcd9c20b0cb3ca17d862d8671"
+    },
+    "diffs/19a4082-to-8d52dab.patch": {
+      "bytes": 24463,
+      "sha256": "66d8601d77ac8834966c9726060fd07aee2771046ee18ae5b204e7d8e8b82aff"
+    },
+    "diffs/fa7a980-to-8d52dab.patch": {
+      "bytes": 67197,
+      "sha256": "079ecd1bfadd722b2b6ce59fb5ce2cffc4fd8c4c2d72c5c1156ff812aa6e2d84"
+    },
+    "gates/emission-clippy-8d52dab-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50"
+    },
+    "gates/emission-clippy-8d52dab-1.log": {
+      "bytes": 165,
+      "sha256": "cf4f2df3c1c461e7df0f16cab11fb23d64c003af7914b2a3e772a25bdb0b5a4a"
+    },
+    "gates/emission-clippy-8d52dab-1.result.json": {
+      "bytes": 1969,
+      "sha256": "15695a8f44e699680831072ffd4270be13582834b3935edafe237f24ed3ccc57"
+    },
+    "gates/emission-fmt-8d52dab-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50"
+    },
+    "gates/emission-fmt-8d52dab-1.log": {
+      "bytes": 6446,
+      "sha256": "c1c6b12861c8117ce6ffc6d6742ebf92618aafb10160ec6f99d370ca72ebab2d"
+    },
+    "gates/emission-fmt-8d52dab-1.result.json": {
+      "bytes": 1882,
+      "sha256": "8b96257054feb09bea714724adeebb40056617a64f4ce84b44825a90f34541a7"
+    },
+    "gates/emission-focused-19a4082-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "7f025170115bdf4884b00af20019565c9d214713d5a8f8fc9d78d3c819db4d00"
+    },
+    "gates/emission-focused-19a4082-1.log": {
+      "bytes": 2206,
+      "sha256": "96158d78a50b54963dcd39f1a2e642671cf78bdfa97c995979c71541e7cabdb5"
+    },
+    "gates/emission-focused-19a4082-1.result.json": {
+      "bytes": 4254,
+      "sha256": "33ac77aa4229bd695722d96a7509dfcfef3fbfae327de0cc635d7ceb111426ab"
+    },
+    "gates/emission-focused-8d52dab-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50"
+    },
+    "gates/emission-focused-8d52dab-1.log": {
+      "bytes": 2206,
+      "sha256": "12aa7f28ce98e6ddbcda7a9c99b90748e96eb91d41ba0db825c71814fb99471c"
+    },
+    "gates/emission-focused-8d52dab-1.result.json": {
+      "bytes": 4253,
+      "sha256": "e8f025c0a99a2da2ed99dc249553c5d0c68970891f1dfcc0a28c58ee2685e443"
+    },
+    "gates/emission-full-19a4082-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "7f025170115bdf4884b00af20019565c9d214713d5a8f8fc9d78d3c819db4d00"
+    },
+    "gates/emission-full-19a4082-1.log": {
+      "bytes": 17309,
+      "sha256": "7a23c1151cfba02f6527bef6c8ffd53ffa5eac0e0598e37728733bc85230e538"
+    },
+    "gates/emission-full-19a4082-1.result.json": {
+      "bytes": 21554,
+      "sha256": "18bde5e85d43454f3e8b4556c35acc527ed22def1f6a8b0b8a61269e7c3a600b"
+    },
+    "gates/emission-full-8d52dab-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50"
+    },
+    "gates/emission-full-8d52dab-1.log": {
+      "bytes": 44295,
+      "sha256": "1a31c94c3f0a0b6157be381118ee6a9d708b3241c545c8d7f99bc3de94d78871"
+    },
+    "gates/emission-full-8d52dab-1.result.json": {
+      "bytes": 40105,
+      "sha256": "431a7080e8d8279b4cd4dc1da039acf021200018a052de047c4927ef461f07a4"
+    },
+    "gates/emission-list-8d52dab-1.inputs.json": {
+      "bytes": 103842,
+      "sha256": "42b4e07ac4d92c0e4f04d98db862e57f95ad7bf9b5fb3b485d7e0cc971918b50"
+    },
+    "gates/emission-list-8d52dab-1.log": {
+      "bytes": 30793,
+      "sha256": "a32bff2e98b6ca5e72e9d2c07df0068cb31b30f013824d35c2a639499c3c4e38"
+    },
+    "gates/emission-list-8d52dab-1.result.json": {
+      "bytes": 33038,
+      "sha256": "cd28c5314dedc75b1b00ab93482c06f6655e45c4aadf938ea4b75031a4929d0b"
+    },
+    "gates/launchers/443721caa8c537a5775b74fb680884a6d0cfda3fb39524cc00df1589640669fb.py": {
+      "bytes": 7662,
+      "sha256": "443721caa8c537a5775b74fb680884a6d0cfda3fb39524cc00df1589640669fb"
+    },
+    "gates/launchers/7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401.py": {
+      "bytes": 7662,
+      "sha256": "7819914383abe8a578676aed661704c7ecd0ce9894491152e1859035316e8401"
+    },
+    "launchers/package_evidence.py": {
+      "bytes": 4782,
+      "sha256": "6a29202edfb0e428a3465239f5df4a7ead43801657e649130bfb73be277e99a4"
+    },
+    "notes/prior-toolchain.txt": {
+      "bytes": 536,
+      "sha256": "1f101518dd1f90bc2cba8d26570a762832aba6debebbbe6aa50f97a944590610"
+    },
+    "reviews/EMISSION-RUNTIME-READBACK.json": {
+      "bytes": 5930,
+      "sha256": "c9d4abb060a34e862769c4a6428da560cb5bb4f6daf82b57d1ad5ff828b9b55e"
+    },
+    "reviews/RUNTIME-REVIEW.md": {
+      "bytes": 6533,
+      "sha256": "9f5b82297398da0673659e25c174ac7d43747af130d3d1ca5c53ba80d53c4212"
+    },
+    "reviews/SOURCE-REVIEW.md": {
+      "bytes": 6175,
+      "sha256": "671ad93c4c5f9e015e4d01ba33dae4dd2ff8bc9f2142d7f5ab6accf990e609b1"
+    },
+    "reviews/STACK-DIAGNOSIS.md": {
+      "bytes": 4435,
+      "sha256": "3bf719721f497a7b4b31d5817bce54fb9bd9e51a208dc570f5a4f164de3859f6"
+    },
+    "reviews/STACK-REPAIR-REVIEW.md": {
+      "bytes": 3562,
+      "sha256": "e0edd058f64e1289e5111390ebe8e028ebd6cb548918b5a5e61d6f610f44a80d"
+    },
+    "reviews/TEST-REVIEW.md": {
+      "bytes": 8757,
+      "sha256": "73123c2da3ccb3be97f3cf2cce1fde170804008cc629342bec31eadc57b0c416"
+    },
+    "reviews/inspect_runtime.py": {
+      "bytes": 10361,
+      "sha256": "aec366f529b9c8466316a304bcc7ca6688863be2b8da88f03d94cb6a8114019b"
+    }
+  }
+}