ARCADIA-Studio/harness/experiments/analysis-carried-phase-20260925/SOURCE-REVIEW.md

Independent carried-phase production source review

2026-09-25. No concrete correctness blocker found; compilation and runtime acceptance pending. Reviewed uncommitted production changes over 18073a6f2eabce83fc83997f094e331eec835a16 in .local/as3batch. Tests were still being authored and are outside this source-review verdict. No source edits, Cargo, application execution or network actions were performed.

Authority: selected harness/analysis-carried-phase-contract-20260925.md, SHA256 d17c28a8bb138063c8c5fbf3ed5850f3c1531047d217dffa7274e8d6339fb6b9; independent CARRIED-PHASE-ORACLE.md, SHA256 56d1b57f4322c74bfd52f46483e337213fb6f8edf26d5756228b6e34c83692fd. Paths below are under crates/oa-core/src/language/analysis_source/.

Reviewed production file	Exact working-file SHA256
mixed/carried.rs	b376844c42660fec462def3e839ed99db272e5752ba137c885e69cad01c29e6c
mixed.rs	78422c978f9eaf490145ec13bf68928a87966e83370fbf7e5076282e1d578b8b
budget.rs	24656fe30fe17b3d7ae295b2e1eeb0a5e5e7bc4fbc4f30cdd95e3e72e1b54f66
mixed/project.rs	951dfceb111faa10bf795ec73646b794b08cca81e450b02f13a987a49d9f36ee

Correctness and authority findings

• Bound owner and lifetime: carried.rs:6–43 keeps policy/owner fields private; CarriedInput is neither Clone nor Copy. Retained backing borrows the actual allocation-owning RetainedSnapshot. The bundle method derives the reference from that backing. parse_carried takes only the input, derives bundle and exact policy, and moves the guard into the parser (:65–69). Syntax retains the optional guard (mixed.rs:46–50,401–408); existing consumed resolve/index ownership retains syntax. There is no returned self-referential owning bundle or exposed guard-removal method. Rust lifetime/type checking still needs compilation.
• Construction is fixture-only: policy capture, retained fixture construction/input and borrowed input construction are all cfg(test) (carried.rs:71–119). The retained fixture counts exactly F entries, zero lower occurrences and the actual entry/key/source UTF-8 bytes with checked additions. It does not claim preallocation admission of its fixture allocation. No production nonzero or zero-carry transition is enabled; no emitter authority is implied.
• Internal parser seam: parse_impl accepts separate arguments and could be misused by future internal code, but its current two callers are fully accounted for: legacy passes None; private parse_carried derives all values and Some(input) from the same guard. No intended API currently allows substitution. This is a sufficient current private caller invariant, not a concrete vulnerability requiring an input-enum redesign. Re-review any future caller or constructor against this invariant.
• Exact policy and independent work: Budget::limits (budget.rs:67–70) returns the immutable complete Limits value. Policy capture retains complete ProjectLimits too. The shared parser constructs one new Budget using those values and preserves the previous maximum-policy validation. There is no policy subtraction, default reconstruction, per-include reset, or modification of an existing Budget. Carried slots never enter Usage or numeric work counters.
• Explicit mode preserves legacy checks: parse_with_profile delegates with None. The initial and per-file branches preserve its old independent metadata checks; it gets no new completion check. Some(input) always performs combined checks, including borrowed zero carry (mixed.rs:282–301,348–358,396–400). Grammar, scanning, ordinary projection and traversal remain shared and unchanged. Thus the oracle's legacy E cap11 versus carried-zero cap11 distinction is represented directly rather than hidden behind C == 0.
• Checked, noncharging aggregation: CarriedInput::check composes C+U+M with existing checked Slots::add and validates all three dimensions through a temporary zero Ledger (carried.rs:45–61). The temporary Ledger retains no reservation in the returned witness. All errors propagate immediately through the existing safe diagnostic path. Continuation C is checked before complete-source precheck/traversal; initial C+file metadata is checked before Traversal::new; per-file prospective metadata is checked before position projection; final check follows successful traversal. The old token/value-end/position/owner metadata components occur once.
• Once-only resolver transfer: project.rs:438–449 seeds live Slots from the retained guard, or zero for legacy, then calls the unchanged syntax admission once. The existing syntax walk adds U+M, owned text and bounded scratch. Existing catalog/lower releases subtract their recorded local reservations, not C. There is no new release/reset path for the baseline. Resolved retention should therefore equal the zero-carry result plus C exactly; actual cap boundaries still require runtime verification.
• Failure attribution and ownership: parser failures use the entry or current-file closure at the appropriate checkpoint; resolver errors retain existing canonical file/span transport. The guard and partial syntax are consumed/dropped on refusal, while the external fixture owner remains alive under its own scope. No partial witness, reusable continuation or accepted edited output escapes. Default parser span transport remains distinct from resolver full-span transport as the oracle documents.

Temporal scope and stack risk

This implements phase checks, not admission before every parser allocation. Unit ASTs/tokens and counting scratch already exist before the per-file check; new retained syntax text is accounted only by the existing resolver walk. Existing model/serde/raw-validator and physical allocator/RSS exclusions remain unchanged. No fresh source rescans, Exact conversions, model clones, heap work containers or per-include budgets were introduced by the production path.

Adding inline CarriedInput to ParsedMixedSyntax and adding a shared parse wrapper can change debug stack frames even on the legacy route. From source field widths on the intended x64 target, the borrowed enum payload is approximately 112 bytes (bundle reference8 + Limits48 + ProjectLimits56), versus a retained reference8; actual enum/Option and frame layout is compiler-dependent and was not measured here. This is a concrete reason to retain compiler/strict-Clippy and existing small-stack regression gates, not evidence of a regression or justification for speculative boxing. Existing upstream environment-sensitive parse-stack failure remains unresolved and separate.

Pending acceptance

Compile/type-check the guard lifetimes and moves, and run strict Clippy before drawing layout/lint conclusions. Independently exercise oracle E/H boundary pairs, exact parser-versus-resolver spans, new-snapshot work counts, retained +C slots, text timing, all inherited policy fields, and zero-mode rejection timing. Entry/text/occurrence overflow injection must remain labeled separately from positive owner provenance; the actual retained owner has zero occurrences. Test failure/drop and unchanged owner bytes through real parse/resolve paths, and preserve prior private/legacy outcomes, 16 inherited full-suite failures and formatting disposition. This review neither certifies unfinished tests nor accepts final emission/readmission or public source8.

Committed test-observer supplemental readback

Reviewed commit d11b99bb4ab1c817951557551db3a3c7cbd5c425. The four working production files match that commit. mixed/project.rs now has SHA256 d0b75ec30c4e433d942d8011f13ddc8321a7c060e35c7b0a320b0979fe22bc40; the other three file hashes above remain exact. The sole additional change in the previously reviewed project file is the cfg(test) ResolvedMixedProject::phase_state observer at lines31–34, returning (&self.syntax, self.storage.live).

The observer returns an immutable borrow tied to the resolved owner and a copied scalar Slots snapshot. It cannot mutate/reset policy, replace the bundle, extract the guard, release ownership or construct a continuation. It is absent from production builds and provides the intended test visibility into real retained state. No authority issue or new source-review blocker found. This supplement does not claim unchanged runtime behavior: compilation and all required runtime gates remain independently pending. No source edit, compiler or application execution was performed for this readback.

Targeted slim-guard repair review

The subsequent d11b99b full run aborted with exit3221225725 at the existing ordinary-index 128 KiB test, despite the 12 focused tests passing. Read-only inspection of carried-full-d11b99b-1.result.json and carried-debugger-d11b99b-1.log confirms the reported overflow and a fault stack through Exact parsing, the shared parser body and its new wrapper. It does not establish a single quantified cause. The initial source verdict therefore did not establish legacy runtime compatibility; this regression blocks acceptance until repaired and rechecked.

Reviewed the frozen uncommitted slim-guard candidate relative to d11b99b and the revised selected contract, SHA256 875b26eb850ab75d6e09222be37327a87a5b4c4a6f0557adf9723984f945d5f5. No source correctness blocker found in this targeted repair; runtime effect remains unproven. Exact candidate hashes:

File	SHA256
mixed.rs	9e67891b6610def59d39376ec78fea6151025e977c88d299dafd97b440ab4e89
mixed/carried.rs	32cf742631490a624e0522db82ff1d708e5d730b54a117f254ed3a106f05eca0
mixed/carried/tests.rs	794c8e987b43d4a652361bf7e31eff314f917955824efdbb1ba74b0216c4018a

CarriedInput::into_parts consumes the original input: Borrowed moves its captured exact policy; Retained copies the exact policy values from its immutable owner. Both derive the same bound bundle and small guard in one match. The new Budget and syntax ProjectLimits own the transferred policy, so dropping the original seed before parsing remains valid. No policy borrow from the dropped seed is introduced. Only CarriedGuard { Borrowed | Retained(&owner) } travels through the shared parser and later witness; Borrowed source lifetime remains tied by syntax.bundle, and Retained continues borrowing its allocation owner. Private construction/caller invariants remain intact.

Slots/check arithmetic, once-only seeding, all phase checkpoints, modes and Usage are unchanged. No heap allocation or new logical container reservation is introduced. Removing duplicated inline policy from later witnesses is a smaller change than adding a policy-owner fixture lifetime or boxing the policy; it directly reduces replicated state while preserving the contract. The extra parser wrapper itself is unchanged and may still matter; only the unchanged regression gates can demonstrate recovery.

The carried test delta changes only the guard-variant identity check and access to the existing direct overflow checks through into_parts().2. Expected values and assertions remain intact. budget.rs and mixed/project.rs are unchanged from d11b99b. The complete existing mixed/project/ordinary_index/tests.rs, including the 128 KiB regression, is unchanged from accepted18073; working SHA256 04e11463a7d489c9984d165d80718d95da027c7613a5b63180f0eaf4038a0395. No stack size, old fixture, thread setup or old expected outcome was weakened. Compiler, focused/full and required regression evidence must bind the actual repaired commit before acceptance.