ARCADIA-Studio/harness/release-source7-core-checkpoint-20260906.md

Source 7 core checkpoint — 6 September 2026

Scope: core implementation of the ratified contextual-chain and interface-operation contracts. This is a component checkpoint, not release acceptance or evidence of native, REST, recovery, or desktop completion.

Latest integrated verification: cargo test --locked -p oa-core --all-targets passed 433 tests, zero failed, one explicitly ignored inheritance-scaling probe, across44 target summaries. The fresh green invocation took138.72s including compilation; log .local/source7-core-all-targets.log. It supersedes the cumulative-only count below and includes the traversal-budget and four operation-composition corrections. Workspace/all-target strict Clippy also passed in .local/source7-workspace-clippy2.log; desktop review needed two equivalent style corrections, with no core change.

Implemented contract

• New caller-owned ContextualLink with qualified reference-occurrence paths and closed Precedence, Exchange, and CommonWork purposes. The shared TopologyIndex resolves complete endpoints and incomplete picker scopes, preserves repeated/nested instance identity, and produces separate precedence/assembly projections and qualified advisory diagnostics. Existing direct SequenceLink semantics remain unchanged.
• Optional exact operation-allocation identity on SA BoundaryInterface Call/Asynchronous occurrences. Ordinary None is omitted in serialized records. Explicit unresolved intent preserves values; selected intent requires actual concrete port, interface, direction, item and transmission proof. Reply derives the correlated Call's signature and independently validates its channel.
• Typed reference lifecycle, caller-owned source placement, exact history, qualified transition mapping, explicit reverse operation-omission rationale, and typed semantic-review facets. Reverse dependency discovery does not introduce technical allocation dependencies solely from an operation being explicitly abstracted.
• One schema/source 7 increment. Versions 1–6 reject new constructors and fields, including explicit null operation fields. Old nonempty Call/Reply record serialization remains unchanged; source migration changes the version token while preserving module bytes and comments.

Public seams are in crates/oa-core/src/model.rs, topology_context.rs, topology_context/analysis.rs, and operations.rs. Desktop uses those resolvers; it must not infer qualified ownership from generic leaf endpoints. resolve_scope supports raw endpoint drafts without fabricating a selected leaf.

Verification and corrections

cargo test -p oa-core --tests --no-fail-fast --locked produced 425 passing, one failing and one ignored test in .local/source7-all-core-tests2.log. The sole failure was an old test expecting migration's current token to be 6. Changing that expectation to SCHEMA_VERSION preserved its schema-5 input and exact trivia comparison. A fresh complete communication_means target passed 9/9 in .local/source7-communication-means-final.log. Combined component coverage is 426 passing and one ignored, with no remaining observed test failure. This is not a claim of one wholly green full-suite invocation.

The fresh full run includes all 12 source7 contract tests, all 39 core unit tests, and all four teaching-project tests. Teaching equality passed after root changed only the three current generated version tokens; no additional model regeneration was needed. Earlier failures and corrections are preserved in the ignored source7 logs. Current-version expectations changed; frozen historical fixture bytes were not rewritten as current models.

The new tests exercise OA and SA repeated/nested references, R1/R2 distinction, cache eviction, qualified branch advice, assembly incidence without invented precedence/global coverage, path depth/accounting, deletion/retarget/reidentify, source-module ownership and token-only upgrade, exact Undo/Redo, typed semantic observations, parameterless operation identity, missing channel/lifeline/direction proof, separate void Reply channel, unresolved retained values, and reviewed reverse abstraction.

One consequential integration correction preserved the established independent channel contract: deleting a sole operation allocation cannot leave a boundary carrying an unadmitted item. Tests pin refusal without mutation, successful explicit channel repair with retained unresolved values, and successful deletion when another interface allocation admits the item without substituting that surviving allocation as the selected operation. This is the root-ratified lifecycle clarification, not a scenario-specific relaxation of port validation.

The normative language sections 4.2.1 and 4.3.1 were compared with the implemented contract after these corrections. Selected operations now reject missing concrete proof; explicit unresolved intent remains editable. Authored paths use existing caller-specific ParseLimits (REST 50,000, desktop 500,000, core caller policy), separate from depth 64 and analysis budgets.

Open acceptance work

Independent review immediately after the initial checkpoint found that the analysis edge limit bounded stored output but did not stop traversal of later authored edges/repeated instances. A concrete 1,000-reference × 1,000-parallel-link model could examine roughly one million edges after reaching the 100,000 limit. The subsequent correction reserves actual work before each authored endpoint resolution and each synthetic/legacy edge, including attempts that produce no stored edge. Exhaustion stops traversal through ancestor frames and returns no inferred partial entry/exit boundaries. Node-budget exhaustion uses the same stop propagation. A single located budget notice marks the analysis incomplete.

Three new internal tests passed in .local/source7-analysis-work-limit-tests.log (33.22-second compilation, 3.49-second execution): the actual million-edge fixture stops at 100,000 examined attempts and before later reference nodes; cache capacity 1 cold/warm and capacity 0 produce identical output; unresolved authored endpoints consume work despite zero stored edges; and exact edge budgets include synthetic entry/exit connectors. One fewer permitted connector and a node-limit abort both report incomplete with no fabricated bypass. The counter is actual reservations before examination, not stored-vector length. This closes the identified edge-work defect within that measured scope.

Fresh language 16/16 and source7_contract 12/12 passed afterward in .local/source7-core-after-work-limit2.log. Their first rerun found the normative-example test collector recognized only historical literal headers 2/3/4/6 after root upgraded the current prose examples to 7; it now recognizes 1 through SCHEMA_VERSION and actually parses the examples. Combined baseline plus the three new tests is 429 passing and one ignored, with fresh affected-target evidence. The full core suite has not been rerun after this bounded traversal correction. Core ownership and the sole Windows Cargo lease were released to the desktop worker after the green focused run.

Final default-node-limit scale evidence is still needed. Graphical authoring, exact contextual semantic composition, old/new checkpoint restore, REST admission/limits, native readability and Save/Undo/Redo/reopen remain independent integration gates outside this core report. No source7 release completion is claimed.

Follow-up operation evidence: four additional test-only cases in source7_contract.rs exercise actual reverse unoriented channel traversal with exact Reply correlation; inherited exposure versus a separate same-item allocation requiring its own explicit caller requirement; all Call/Asynchronous × Synchronous/Asynchronous/Unspecified combinations; and allocation deletion that repairs both the Call and separate Reply channel while retaining raw InOut values through Undo/Redo. The entire target passed 16/16 in .local/source7-operation-composition-tests2.log (4.88-second compilation, 0.35-second execution). The initial compile required cloning the non-Copy MessageKind in the test matrix; no production defect or semantic expectation adjustment was needed. This closes those four previously listed composition-evidence gaps. Scoped cumulative core coverage is now 433 passing and one ignored across the original full run and affected-target reruns, not one fresh full-suite invocation. The Windows Cargo lease was released immediately after the green target.