[M14 acceptance] Verify validated mutation, refactoring reuse, and agent-facing contracts

[Teakowa]

Parent: #127
Depends on: #128, #129, #130, #131

Goal

Independently verify that M14 delivers one coherent validated source-mutation architecture across Wright's supported source/tooling surfaces, and perform a post-M14 roadmap reassessment before broader refactoring scope is added.

QA scope

• Verify [M14 foundation] Make source-edit transactions project- and frontend-aware #128 source-edit transactions against actual OPY/OSTW project/session semantics, including atomic preview, source/version preconditions, overlays, cross-file provenance, stale refusal, and conflict handling.
• Verify [M14 refactoring] Unify semantic rename across OPY and OSTW on validated edit transactions #129 semantic rename edits only the resolved semantic identity across the declared OPY/OSTW surface and does not fall back to textual replacement.
• Verify [M14 agent tooling] Expose validated source-edit preview and semantic rename through the shared tool API #130 tool/embedding mutation requests are transport-neutral, structured, preview/validation oriented, and do not write files or expose mutable IR.
• Verify [M14 language services] Converge LSP rename on the shared semantic refactoring contract #131 language-service/LSP rename is an adapter over the shared refactoring contract and preserves accepted M10 URI/UTF-16/version/multi-file behavior.
• Verify unsupported/unsafe cases return structured diagnostics and no partial transaction/output.
• Verify reconstruction from [M13 reverse] Reconstruct the declared Workshop surface as valid OPY source #124/[M13 reverse] Reconstruct the declared Workshop surface as valid OSTW source #125 is not used as the mutation mechanism for existing OPY/OSTW source.
• Run current compiler, tooling, compatibility, LSP, distribution, and CI gates at the accepted commit.

Architect confirmation

Confirm:

• semantic understanding and source identity own mutation decisions;
• edit/refactoring contracts are source-oriented and do not freeze HIR/WIR layout;
• compiler/session owns validation semantics, while LSP/tool transports remain adapters;
• OPY and OSTW do not maintain separate edit-validation architectures;
• no filesystem mutation is hidden inside semantic/tooling core;
• no new refactoring/plugin/compatibility breadth was added without evidence.

Acceptance criteria

• [M14 foundation] Make source-edit transactions project- and frontend-aware #128–[M14 language services] Converge LSP rename on the shared semantic refactoring contract #131 are independently verified from current code/tests/CI rather than issue state or implementation-agent self-report.
• OPY and OSTW validated edits run through the correct native frontend/project semantics with source-located diagnostics and atomic refusal.
• Semantic rename is shared, identity-based, and project-aware for its declared support boundary.
• Agent/embedding consumers can obtain validated edit/rename previews through stable structured Wright-owned contracts without LSP or harness coupling.
• LSP rename reuses the same underlying semantic/edit transaction contracts and retains M10 correctness guarantees.
• Unsafe, stale, conflicting, ambiguous, and unsupported operations do not produce partially applicable edits.
• Whole-source reconstruction is not the default mutation architecture.
• Current CI is green with required jobs executed.
• PM records a post-M14 reassessment and does not automatically expand into extract/inline/formatter/general AST mutation.

Non-goals

• Implementing additional refactorings during acceptance.
• Expanding OPY/OSTW compatibility.
• Reopening [v0.2 workshop-rs] Define Workshop catalog, locale, extension, and version boundaries #96 without a concrete trigger.
• Designing a plugin ABI or generic mutation framework.

Relationships

• Final acceptance/replanning gate for [M14] Validated source edits and semantic refactoring across Wright frontends #127.
• Must complete before any broader source-refactoring milestone is decomposed.

[Teakowa]

Independent PM verification does not accept #132 yet.

PR #133 / da89ab6 has green CI and the #129/#130/#131 architecture is broadly correct, but #128 still has transaction correctness blockers: coordinate drift when multiple same-source edits are applied after a length-changing replacement, invalid columns are silently clamped, and compile-invalid transactions still return a Some(preview) despite the atomic validated-preview contract.

#132 must remain blocked until #128 is repaired with focused regressions and the resulting PR head passes the full CI suite. See the PM review on PR #133 and #128 for exact required cases.

[Teakowa]

Acceptance sequencing update: the earlier independent #132 verification cited da89ab6, but #128 transaction correctness was subsequently repaired at 264fa43. PM has re-verified the specific blockers and found them resolved; PR #133 has 22/22 checks successful at 264fa43. Final #132 acceptance should explicitly evaluate the current repaired head (or later successor) so M14 is not accepted on stale evidence. No additional refactoring/compatibility scope is requested.

[Teakowa]

M14 #132 acceptance — independent verification at PR #133 head 264fa43

Verdict: ACCEPTED. All gating steps green at the current PR head; no correctness/architecture blocker found. This is an independent re-verification from the repo state at execution time — no issue-comment or implementation-agent claim was relied upon.

Verified at execution time (2026-08-16):

• PR M14: validated source editing across Wright frontends (autonomous checkpoint) #133 head: 264fa43183b5ab0c6dc4d1bb88292f0b7e7c7473 (gh pr view 133 headRefOid), state MERGED.
• Merge commit: fb0d57b5097e8a82c76c6f1a5c7494ecfd2ce2ce; git diff --stat 264fa43 fb0d57b is empty (tree-identical merge).
• PR commits: e8810ab ([M14 foundation] Make source-edit transactions project- and frontend-aware #128 foundation), 2583ca6 ([M14 refactoring] Unify semantic rename across OPY and OSTW on validated edit transactions #129), e3f4901 ([M14 agent tooling] Expose validated source-edit preview and semantic rename through the shared tool API #130), da89ab6 ([M14 language services] Converge LSP rename on the shared semantic refactoring contract #131), 264fa43 ([M14 foundation] Make source-edit transactions project- and frontend-aware #128 blocker fixes added after the earlier acceptance run).
• CI at head: 22/22 check runs success (11 distinct checks): Rust quality (stable), Rust quality (1.85.0), Native-vs-reference frontend differential, OverPy-to-HIR adapter, OverPy compatibility oracle, OSTW compile differential ([M13] Compile the accepted OSTW corpus slice to Workshop with reference differential validation #119), OSTW reference baseline, Distribution validation (ubuntu-latest / macos-15 / windows-latest), v1 release gates. Captured via the check-runs API to {SCRATCH}/head-ci.json / gh pr checks 133 to {SCRATCH}/head-ci.txt.

#128 — source-edit transactions (re-checked, including post-acceptance blocker fixes)

cargo test -p wright-driver --test edit run twice: 20/20 pass both runs (captured to {SCRATCH}/driver-edit.log). The six blocker regressions plus the broken-include preview regression exist verbatim in crates/wright-driver/tests/edit.rs at the head and pass:

• same_line_edits_apply_against_the_original_snapshot_when_length_changes
• later_edit_after_a_multiline_replacement_keeps_original_coordinates
• semantic_rename_same_line_occurrences_with_longer_and_shorter_names
• invalid_columns_are_rejected_not_clamped
• same_position_zero_width_edits_are_refused_as_conflicts
• compile_invalid_transaction_returns_no_validated_preview
• opy_broken_include_edit_refuses_with_the_include_path_in_the_span (preview None on failure)

By-inspection of the shipped contract (crates/wright-driver/src/edit.rs): apply_transaction groups per source and applies edits in descending position order against one original snapshot (no coordinate drift); apply_edit validates every column strictly 1-based in 1..=char_count+1 and refuses with edit-invalid-range (never clamps); EditTransaction::new refuses order-dependent zero-width combinations at one position with edit-zero-width-conflict and overlaps with edit-overlap; validate_transaction returns ok=false with no validated preview on any failure (stale/unknown sources, malformed ranges, or compiled/semantic-invalid edited projects) and validates through the correct native frontend for the original source kind (OPY with include overlays, OSTW with the ds.toml project graph) — no synthetic edit.opy, no filesystem write.

#129 — semantic rename (shared, identity-based)

• Driver: the semantic_rename_* cases pass in the edit suite above (identity-only edits, cross-file OPY, cross-file OSTW, collision/unresolved/breaking refusals, same-line longer/shorter names).
• Language service: cargo test -p wright-language → 59 tests pass (document 8, service 9, cross_file 6, overlay 35, perf 1), including rename_edit_ranges_use_utf16_offsets_after_non_bmp_text and the overlay rename cases (captured to {SCRATCH}/rename.log).
• By-inspection (crates/wright-language/src/service.rs): rename delegates per affected open root to wright_driver::edit::semantic_rename (shared semantic index resolves the exact identity; only that identity's occurrence spans are edited as exact-range edits), unions + dedupes the transactions, and validates through wright_driver::edit::validate_transaction against every affected root before success. No plain-text whole-document replacement exists in the rename path (no source replace(/match_indices); refusals — unresolved, collision, stale source, failed edited-project validation — are explicit ok=false results.

#130 — ToolService mutation (in-process and transport agree)

• cargo test -p wright-driver --test service → 14/14 pass (OPY + OSTW validate-edit/semantic-rename through ToolService); cargo test -p wright-cli --test serve → 7/7 pass (stdio + JSON-RPC transport, incl. transports_are_equivalent_for_mutation_operations) (captured to {SCRATCH}/serve-mutation.log).
• Launch check through the real wright-serve binary ({SCRATCH}/serve-mutation-launch.log): validateEditTransaction run twice over stdio — both responses are the full envelope (ok:true, exit:0, per-source preview with new_text + source_identity), byte-identical across the two runs; semanticRename over JSON-RPC returns the full envelope (ok:true, exact-range transaction edits, validated preview); a target-collision rename (score→hasStarted) refused identically twice with structured rename-collision, ok:false, transaction:null — all-or-nothing, never partial.
• By-inspection: ToolRequest::ValidateEdit/SemanticRename are structured, transport-neutral owned types handled by calling the shared validate_transaction/semantic_rename; the stdio/JSON-RPC adapters are thin mappings with no semantic logic; capability advertisement includes both operations.

#131 — LSP adapter (pure mapping over the shared contract)

• cargo test -p wright-lsp --test lsp run twice: 25/25 pass both runs (captured to {SCRATCH}/lsp.log), covering multi-document workspace edits, unversioned filesystem-backed form, per-document versions, unresolvable/stale refusals, strings/comments untouched, OSTW through the same adapter, and UTF-16/non-BMP positions.
• By-inspection (crates/wright-lsp/src/main.rs): the textDocument/rename handler calls the shared service.rename(...) and maps the result to documentChanges/TextDocumentEdit with per-document versions (source_version = document version, None for filesystem-backed), one TextEdit per semantic occurrence, no changes-only fallback; shared refusals surface as explicit LSP errors (-32602). No protocol-layer symbol/collision/stale logic exists.

Full local gate set (all run at the head)

cargo fmt --all -- --check clean; cargo clippy --workspace --all-targets --all-features -- -D warnings clean; cargo test --workspace --all-targets --all-features green (55 suites, 0 failures); python3 -m unittest discover -s compatibility/tests 18 tests OK (1 skipped: the manifest probe needing the pinned OverPy oracle); python3 scripts/v1-gates.py pass; python3 scripts/run-scenarios.py 7/7 pass; cargo run -p wright-bench no regressions. All reports written under target/ (v1-gates, scenarios, bench, differential ×2, reconstruct ×2, convert). Captured to {SCRATCH}/full-gates.log.
Network/platform-bound oracle jobs were not locally runnable (compatibility/oracle/node_modules absent — pinned pnpm deps; OSTW v3.4.0 reference absent — needs network acquire): the local limit is recorded in full-gates.log, and both are green on the head's CI ("OverPy compatibility oracle", "OSTW reference baseline").

Architecture invariants (grep over the head tree; {SCRATCH}/inspection.log)

• No reconstruct call in the mutation-path surfaces (driver edit/service, language service, LSP) — [M13 reverse] Reconstruct the declared Workshop surface as valid OPY source #124/[M13 reverse] Reconstruct the declared Workshop surface as valid OSTW source #125 reconstruction is not the mutation mechanism.
• No LSP protocol types in wright-driver.
• No fs::write in edit validation or the tool service (application/writing is consumer responsibility).
• No hard-coded SourceKind::Opy/edit.opy in edit validation: resolve_kind returns the configured kind or detects from extension; compile_project/build_overlay dispatch per kind with both OPY and OSTW arms; Workshop/Protocol inputs refuse explicitly (edit-unsupported-kind).

No production change

The acceptance run modified no production behavior and created no commits. The working tree after the run shows only the pre-existing uncommitted change (crates/wright-driver/src/session.rs diag-helper visibility, matching the head's committed state) and the pre-existing untracked .opencode/.

Post-M14 reassessment

Ratification of the post-M14 roadmap reassessment remains a PM/human action; this acceptance references the draft already in this PR's body and makes no further scope claim.

Independent verification performed from repo state at 264fa43; evidence logs under {SCRATCH} (head-ci, driver-edit, rename, serve-mutation, serve-mutation-launch, lsp, full-gates, inspection).