PyCForge 1.1.2 — conversion correctness audit
============================================

Basis and scope
---------------
This work continues the updated runtime-values and Ting integration delivered
above, built on the uploaded PyCForge 1.1.1 source. It does not use the 1.2
compiler-integration branch. C-to-assembly belongs to PlutoAI.

The default typed converter, PySide6 workspace, existing splash, six Ting
rulepacks, screenshots and public links are retained. The runtime-values
backend remains an explicitly selected Preview action. PyCForge's package
version is 1.1.2, without an alpha suffix. The vendored upstream Ting version
remains its actual version, 0.10.0a21; it has not been renamed.

The audit examined both conversion paths, executed owned test fixtures with
CPython and independently compiled C, and checked the installed desktop.
No compiler or Python/C execution feature was added to the application.

Demonstrated problems fixed
--------------------------
1. Runtime integer true division lost precision before the division.
   int(9007199254740993 / 3) produced 3002399751580330 instead of Python's
   3002399751580331. The runtime now rounds the exact signed-int64 ratio to
   binary64, including ties to even and signed zero. It does not depend on
   a platform having a wider long double. The regression checks 7,862 ratios
   bit for bit, using boundary values, all signs and a deterministic random
   corpus; both operands are supplied to the generated C at runtime.

2. Repeated access to the same bound method compared unequal.
   box.value == box.value and items.append == items.append now compare equal.
   Equality checks receiver identity and the underlying method. Different
   receivers and different methods stay unequal; separate lambdas retain
   distinct identity. Tests include stored methods, membership and count.

3. Runtime functions and lambdas accepted duplicate parameter names.
   Python's ast.parse accepts some programs that Python compilation rejects.
   The emitter now rejects duplicate names, including duplicates across the
   positional-only separator and method/lambda parameters, without emitting C.

4. Both conversion paths accepted writes to Python's reserved __debug__ name.
   The shared parser check rejects reserved assignments and bindings before
   elaboration, including parameters, declarations and comprehension targets.
   It inspects syntax; it does not execute or compile the user's Python.

5. The default scalar converter rejected the valid minimum int64 value.
   A standalone return of -9223372036854775808 and a module constant with that
   value now lower to a representable C expression. Values beyond the admitted
   signed-64-bit domain remain outside the conversion contract.

6. Runtime diagnostic positions were wrong after non-ASCII characters.
   AST byte columns are now converted to the editor's character columns and
   offsets. Syntax and tokenization errors retain their source locations.
   Tests cover Unicode before the rejected expression and before a syntax
   error, plus the reserved-binding diagnostics in both profiles.

7. Bare-CR Python source could cause an internal failure in the default path.
   Tokenization now recognizes those line boundaries while retaining the
   original source document and existing CRLF token spellings. LF, CRLF and
   bare-CR fixtures produce the same generated program in both profiles.

8. The desktop breadcrumb observer assumed an active document always existed.
   Updates now clear breadcrumbs for an empty workspace and return safely
   during shutdown. Tests cover opening a document, removing the last document,
   and a late update after closing starts.

Validation
----------
Final suite: 1,345 tests, 19 skipped, zero failures and zero errors.
Native sanitizer suite: 23 test groups passed.

The completed run counts, environment, hashes and exact limitations are in
evidence/correctness_1_1_2/validation_report.json. The following evidence is
included with the source and review bundle:

- Full application regression: converter proof checks, historical contracts,
  worker isolation, UI behavior, documents, actions, resource limits and Ting.
- Native runtime comparisons: strings and Unicode slices, shared lists and
  classes, mixed tuples/lists, annotations, closures, comprehensions,
  evaluation order, numeric boundaries, explicit errors and workload bounds.
- Native default-profile audit: 1,596 function results, covering floor division
  and modulo at signed-64-bit boundaries, nested loops, break/continue/else,
  range endpoint overflow avoidance, required keyword arguments, records,
  fixed containers, set membership and short-circuit/chained comparisons.
- Actual bounded UTF-8 file reads/writes: CRLF/CR preservation, a Unicode path
  containing spaces, empty and maximum-size files, oversize input, embedded
  NUL, invalid UTF-8 and a missing path, with checked error statuses.
- AddressSanitizer and UndefinedBehaviorSanitizer on the native audit groups.
- Arena allocation-failure injection: all 108 allocation points in the
  cleanup fixture are failed individually; every allocated block is released.
- Installation into a separate environment and imports from the installed
  wheel, real NumPy/Numba warmup, all four startup stages, six Ting agents,
  and actual Qt actions for both the runtime and default converters.

Tests execute only developer-owned fixtures. Source conversion inside the IDE
still does not execute the input or generated C. No conversion result is
automatically marked as having external test evidence from this audit.

The initial full-suite attempt found Numba missing from the test environment.
After installing the package's declared NumPy/Numba requirements, the complete
suite was rerun. The initial log is retained as historical run evidence.

Reproduce from the source distribution
-------------------------------------
Install the package dependencies, then run:

  QT_QPA_PLATFORM=offscreen python -m unittest discover -s tests -q
  python -m unittest tests.test_runtime_values_preview -q
  python -m unittest tests.test_conversion_correctness_1_1_2 -q
  python -m unittest tests.test_runtime_arena_cleanup -q

For the Linux native sanitizer run:

  PYCF_TEST_CFLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer -fno-pie -no-pie' ASAN_OPTIONS=detect_leaks=0 UBSAN_OPTIONS=halt_on_error=1 python -m unittest tests.test_runtime_values_preview tests.test_conversion_correctness_1_1_2 -q

The review bundle includes verify_installed.py. Run it outside the extracted
source directory using the interpreter into which the wheel was installed.
The Qt checks use an isolated temporary settings file and owned fixtures.

Limits that remain explicit
--------------------------
The new runtime backend is not a proof of arbitrary Python equivalence. It
uses checked int64 integers, finite binary64 values, valid UTF-8 input and an
arena with explicit workload bounds. Python integers themselves are unbounded.
Arena allocations live until the owning context is destroyed.

Container annotations check current values at declared boundaries; they do
not permanently constrain mutations through every alias. Whole-program linked
static type inference, exact runtime-backend ForgeLens mappings and independent
typed C-IR ownership proofs remain future work. Existing default-backend
evidence is not presented as proof for the new backend.

Imports, inheritance, exception handling, generators, dicts/sets and keyword
or default calls are still outside the runtime-values preview. Some are
supported in narrower forms by the established default converter. See
specifications/runtime_values_1_1_2.md for each backend boundary.

Native Windows installation, desktop operation and C toolchains were not
tested here. Linux offscreen Qt checks do not establish Windows behavior.
Python 3.11 and 3.13 execution also remains unverified in this environment.
LeakSanitizer is unavailable under the hosted tracing environment; allocation
balance injection is separate evidence, not a LeakSanitizer pass.

This package has not been uploaded to PyPI by this task.
