# Independent bounded-outline source review — 2026-09-11

Reviewer: Codex-9e8r6t `/root/linux_readiness`, acting only as a Windows/product
source reviewer. Linux remains paused under user issue 1 comment 350. Read
coordination 338/344/349/351/359 and current source. No patch application,
production edit, compiler, test, UI, WSL, staging or commit was performed.

**Outcome: one P2 correction is required before App integration; one P3 cost
improvement is advisable.** The reviewed proposals and their prepared tests
remain unexecuted. Source reasoning is not a compiler or runtime pass.

## P2 — Header identity recognition exceeds the language's spelling rule

Exact locations: `.local/text-navigation-probe-20260911/outline-seam.patch:190`
retains `Id::parse_str(&text).ok()` in the shared walk;
`source_symbols.rs:419`–423 repeats that permissive decoding. Production
`crates/oa-core/src/language.rs:1233`–1244 first requires 36 decoded bytes and
hyphens at 8/13/18/23. The installed uuid 1.26.0 `src/parser.rs:147`–158 explicitly
also accepts compact, braced and URN forms.

Concrete unexecuted falsifiers substitute each literal below into
`oa_actor a "A" id "LITERAL" {}`:

- `00000000000000000000000000000001`
- `{00000000-0000-0000-0000-000000000001}`
- `urn:uuid:00000000-0000-0000-0000-000000000001`

The real declaration parser rejects each spelling. The proposed outline returns
`Some(Id(1))`; the documented adapter zips it with `id_literal_span`, and query
`identity` at `source_symbols.rs:560`–566 can issue a cross-revision authored
anchor. A malformed header is therefore promoted to an identity that the source
language does not admit. Tolerating the draft is appropriate; minting this
navigation identity contradicts the intended malformed-ID contract. The proposal
author confirmed that this permissiveness was inherited, not intentional policy.

Use the existing decoded header-spelling rule in a shared narrow predicate;
retain the exact quoted literal span but return no authored ID for these forms.
Keep Unicode escapes that decode to an admitted hyphenated spelling valid, and
retain accepted uppercase hex. Ensure the trusted query adapter cannot reintroduce
permissive decoding. Prepared regressions should check outline `id == None`,
preserved literal bytes, and no authored anchor for all three counterexamples.

Compatibility decision: sharing the corrected walk changes `analyze`'s ID result
for these already-invalid headers, although its public shapes remain unchanged.
Record and test that intentional correction; do not silently describe legacy
analysis behavior as byte-for-byte unchanged or add a competing header parser.

## P3 — Unicode path correction repeatedly folds previously visited paths

`query-unicode-path.patch:10`–11 correctly matches core
`source_project.rs:349`'s Unicode lowercase collision policy, including contextual
Greek sigma. However, each file folds every earlier path again. With F paths,
this performs F(F−1)/2 repeated lowercase allocations/comparisons; increasing
loaded files can make rebuilding the index unnecessarily expensive.

Aggregate input admission at `source_symbols.rs:348`–352 occurs first, so this
is not an unbounded-allocation or correctness claim. Prefer one folded key per
path in bounded scratch storage, as core does, after aggregate path admission.
No timing test or measured performance regression is claimed by this review.

## Other reviewed invariants and caller obligations

- The new outline checks source bytes before token allocation and token count
  before scanning the next token. Its declaration cap precedes ID decoding and
  alias/kind copies. Significant-token/body arrays are O(admitted tokens), and
  brace recovery is iterative. The lexer and declaration walk are shared with
  legacy entry points; the new entry does not call lint/model parsing or I/O.
- Original UTF-8 byte spans and CRLF are retained. The EOF fallback at
  `outline-seam.patch:199`–203 includes the consumed name/ID token; closed-body
  matching retains source extent. Full scanning, lexical errors, unmatched
  braces and valid syntax remain distinct. Budget errors return no partial result.
- Query maps preserve repeated aliases and IDs. `references_to:590` refuses
  ambiguous aliases; `resolve_anchor:570` checks uniqueness across all loaded
  files, including detached copies. Snapshot handles reject changed keys.
- App must allocate finite aggregate budgets before accumulating per-file
  outlines and pass remaining budgets, rather than granting each file the full
  workspace allowance. Supply exact lexer classes and proven header roles:
  query preflight validates bounds, not their syntactic provenance.
- Set full-file coverage only after successful outline completion. Included
  membership, complete-project scope and validated evidence require independent
  proof for these exact bytes. Empty matches in partial scope are not proof of no
  project references. Every input/membership/evidence change must advance the
  snapshot key. Convert byte columns explicitly for editor coordinates, and
  revalidate revision on navigation dispatch. The outline alone supplies none
  of those App lifecycle guarantees.

## Frozen inputs

Hashes independently read before review:

| Artifact | SHA256 |
| --- | --- |
| outline-seam.patch | 40B41DFB71F0DAED322FB6B33943CE2EB529D42337E9EA945A67D1F688D6FF36 |
| query-unicode-path.patch | 6978635817B1CB36BBA82D8D45B17BB3C58316122DCC8CD4DE419D343C86A9DC |
| source_symbols.rs | CF82E34544CE508E446787B6335AEFE97E146EA5E7CCA0A9788DEB9097F8F7BB |
| OUTLINE-NOTES.md | 3230D5B33F4FF29114FCACB4E2017F95630D339B88FB7AED0894AAE346A9F890 |
| production language.rs | 638F08A42E9CF4996B5D07F69B4D6F517A518369F3604D25BE1006E40E080765 |
| production source_project.rs | 1394370BCC5908873B830C2C11312E6E1611AF41F46C4F43CA0A6BCB713BB466 |

Root owns correction authorization, immutable test execution, integration and
native acceptance. Peer956's source8/codec/lifecycle ownership is unchanged.