fy59/trainlog
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trainlog/docs/reviews/session_generator_v1_final_review.md

4.6 KiB
Raw Permalink Blame History

SESSION_GENERATOR_V1 — one deep final audit

Date: 2026-09-10. Baseline: fd955315ccc9bb835a13eb94d206f1e01d893dfb. Configured final-reviewer / Terra-high, isolated and read-only. Initial decision: FINAL_REVIEW=FAIL. One bounded repair chain is authorized; do not run a second broad final audit or mark the tranche PASS before repair verification, documentation synchronization and final validation.

Blocking findings

  1. V3 timestamp validation. Python validate_payload() accepted the shared V3 fixture after replacing a session start with not-a-time. Android's common V2/V3 validator likewise checked only nonempty session/body timestamps. Accepted malformed history subsequently fails the generator's correct exact timestamp reader. Repair V3 import and export in both languages to use the existing exact Trainlog parser for session and body instants, rejecting before persistence/publication. Preserve V1/V2 semantics. Test rejection without mutation and malformed-present-V3 precedence over V2.
  2. Current documentation contradictions. Architecture and Android docs retained active-mobile-V2 statements despite V3 implementation, and the V3 section of sync_exchange.md stated duration/rest 1..86400. Rest is actually 0..86400. Correct current-state references, retaining explicitly historical V1/V2 and equipment-associations V2 without semantic changes.
  3. Incomplete golden output comparisons. Shared C/Kotlin fixtures checked subsets of ordinary and selection outputs. Expand one shared corpus to full normalized expected results: every selected identity/context/plan/load/source, rationale/source list, recency and zone/pattern metadata, complete exposure windows/latest/unclassified state, duration, insufficiency and shortage codes. Exercise exact ID/equipment-anchor ties and every named coverage/score rule. Assert the same complete results through both production engines.

Positive evidence and scope

No additional material API/ABI, lifetime, transaction/snapshot cleanup, scientific identity, or deterministic-selection defect was established in this audit. Owned bounded C analyzer input copies, complete snapshot history scans, observed-only external-load anchors, absent numeric MAX, Android normal-draft acceptance and TUI zero-actual initial plans were reviewed positively.

Before repair: Meson 45/45, focused ASan/UBSan 4/4, Android 73 tests with zero failures/errors and one known external real-v9 fixture skip, strict headers, builds and validators passed. Those passes did not establish the missing full output assertions or V3 malformed-time rejection.

Live MTP/device validation remains explicitly outside the automated evidence; no device installation or real-data migration was performed. This limitation is not a blocker and does not expand the bounded repair.

Repair verification

The bounded V3 temporal repair is implemented. It validates V3-only root, session and body timestamps with the settled exact parser before import, publication or persistence, preserves V1/V2 nonempty-string behavior, and retains malformed-present-V3 priority over V2. Focused Python and Android production-path tests passed.

The bounded full-parity repair is implemented. One shared 16-case corpus now asserts complete normalized output through both engines, including all named score/group/tie rules, plans, load provenance, rationale/source lists, exposure, recency, shortages and duration. Focused C and Android runs passed; production engines and the frozen policy were not changed.

Documentation correction for finding 2 records V3 as the active mobile snapshot and occurrence-aware exchange, retains historical V1/V2 and equipment-associations V2, and states rest 0..86400 separately from duration 1..86400. The bounded final repair review subsequently verified that paragraph and returned BOUNDED_FINAL_REPAIR_REVIEW=PASS. The one deep audit remains historically FINAL_REVIEW=FAIL; it was not rerun. Its authorized bounded repair chain, independent verification, and final validation matrix closed all three findings.

Closure

BOUNDED_FINAL_REPAIR_REVIEW=PASS closed the authorized repair chain. The post-repair validation matrix passed: Meson 45/45, named ASan/UBSan 4/4, Android 75 with zero failures/errors and one unavailable external-v9 fixture skip, the executed structural Android v10 migration, validators, strict headers, deterministic regeneration and APK asset comparisons. Therefore SESSION_GENERATOR_V1=PASS. This closure preserves the initial FINAL_REVIEW=FAIL as historical evidence and does not represent a second broad audit.