fix(parser): accept annex-qualified property owners and two-token reference() categories (#434) - #435

Closes #434. Lands all three SPAR-DEFECT parser gaps #427 first measured and #434 re-homed after #429's auto-close orphaned them — legal AADL that OSATE accepts with 0 diagnostics but spar too-strictly rejected. This is a too-strict fix; it is not paid for by loosening anything.

The two parser changes

(a) Annex-qualified property owners in applies to (...) — arp4761.aadl:48, milstd882.aadl:50

) applies to ({emv2}**error type, {emv2}**type set, {emv2}**error behavior state, ...);

The {emv2} lexes as plain L_CURLY IDENT R_CURLY (it is not the {** annex-open token — {emv2} is { then e), so no lexer work is involved, exactly as the issue's parse --tree showed. A new branch in applies_to_category consumes {ident}** and then the owner name — which is multi-word and freely uses keywords (type→TYPE_KW, set→SET_KW) — token-by-token up to the list separator (,/)), rather than expecting a single IDENT.

(b) Two-token component category inside reference(...) / classifier(...) — pok.aadl:52

Slots_Allocation: list of reference (virtual processor) applies to (processor);

classifier_ref consumed only virtual as an IDENT and stopped, leaving processor to fail expect(R_PAREN). A new classifier_ref_list_element lifts the two-token virtual bus / virtual processor forms out to component_category; single-token categories and dotted classifier paths fall through unchanged.

Oracle — third_party_corpora.rs

The three files leave third-party-gaps.txt and MAX_SPAR_DEFECT walks 3 → 0, asserted two-sided in spar_defect_count_matches_ratchet. That assertion is refactored to match on Ordering so it stays clippy-clean at the floor of 0 (x >= 0 is absurd_extreme_comparisons for usize) while keeping both diagnostics — above-floor (a new gap is a regression) and below-floor (a fixed defect whose constant was not walked down).

Non-vacuity (executed against the built binary, not asserted)

A fabricated SPAR-DEFECT row still reds the count assertion (the ratchet bites in the regression direction).

No new too-permissive

osate_agreement.rs and three_way_conformance.rs hold their ceilings over the 120 first-party models. As a side effect of (a), the OSATE-corpus file EMV2TR_Test_Files/MyErrorProperties.aadl now parses and is re-blessed out of spar-gaps.txt; this advances REQ-PLUGFEST-005 by one file only — the other three it names (FG_System_pkg, ModalDualFGS, ThreeStateDualFGS) still fail on a separate, later construct, so -005 is not closed here.

Honest ceiling

Syntax acceptance only: the annex owner path is consumed without validating that the named element exists in the EMV2 meta-model (spar has no EMV2 semantic layer), consistent with how it treats other annex bodies. Not claimed: that these two forms are the last too-strict property-owner gaps.

Artifacts

Adds REQ-PLUGFEST-CORPUS-OWNER-001 (traces-to REQ-PLUGFEST-CORPUS-CLASSIFY-001) and TEST-PLUGFEST-CORPUS-OWNER. rivet validate → PASS.

Verification run locally

• cargo test -p spar --test third_party_corpora --test osate_corpus --test osate_agreement --test three_way_conformance — green
• cargo test -p spar-parser -p spar-syntax (372 tests) + full cargo test -p spar --tests — green
• cargo fmt --all --check, cargo clippy ... -D warnings — clean
• Independent clean-room subagent re-derived every claim above (non-vacuity, ratchet reachability, the 1-of-4 REQ-PLUGFEST-005 scoping, rivet) — all PASS, no over-claim.

🤖 Generated with Claude Code

Generated by Claude Code