ARCADIA-Studio/harness/release-text-navigation-outline-review-v2-20260911.md

Independent outline/query v2 source review — 2026-09-11

Codex-9e8r6t /root/linux_readiness, acting as a Windows/product source reviewer. Read Gitea issue 1 coordination 375/384 and the final frozen proposals supplied by /root/behavior_audit. Linux remains fully paused. Only this report was written; patches remain unapplied. No compilation, formatting, tests, native execution, WSL, production changes or Git/index actions occurred. The v1 review remains preserved.

Outcome: the prior P2 identity defect and P3 repeated-fold cost are addressed in source. No new material implementation defect found. One minor documentation clarification remains. This supports proceeding to root-owned integration review and execution; it is not a compiler, test, memory or native pass. All prepared Rust tests remain unexecuted by this review.

P2 resolved: canonical decoded authored identity

outline-seam-v2.patch:12 extracts exactly the existing decoded 36-byte/hyphen-at-8/13/18/23 rule. Its length check short-circuits before byte indexing. Modern and legacy parser calls at patch lines 114 and 291 preserve their existing UUID parse, error message and offset paths. The accepted/rejected parser spelling set is therefore unchanged by this extraction; this is a shape predicate, not a complete UUID validator.

The shared walk at patch line 221 and query admission at query-admission-v2.patch:40 additionally require UUID parsing. Compact 00000000000000000000000000000001, braced {00000000-0000-0000-0000-000000000001} and URN urn:uuid:00000000-0000-0000-0000-000000000001 spellings now yield no authored identity. A closed malformed header string retains its exact quoted id_literal_span; incomplete/invalid JSON string tokens do not masquerade as valid closed literals. Uppercase and JSON escapes are checked after decoding, while stored ranges continue to address the original raw bytes. A 36-byte correctly hyphenated string with invalid hex remains rejected by Id::parse_str.

The intentional analyze compatibility change is correctly explicit: those already-invalid header spellings previously yielded Some(Id) despite lint rejection and now yield None. Public result shapes remain intact. The retained EOF extent correction also changes incomplete-header spans as documented in v1; neither change should be described as identical tolerant-analysis output.

Prepared coverage is present at outline patch lines 501/532/557 and query patch lines 61/96. The braced-ID query fixture now explicitly sets its empty-body end and asserts that the literal ends before it, so the intended identity rejection cannot be concealed by that helper's old first-brace extent mistake. Lexical navigation with missing identity remains covered. No tests were run.

P3 resolved: one Unicode fold per admitted path

query-admission-v2.patch:21 and line 30 use one retained BTreeSet key per canonical admitted path. This removes repeated earlier-path lowercase allocations and matches production source_project.rs:349's Unicode lowercase collision policy, including contextual Greek sigma. Aggregate file/source/path/token/declaration admission at the unchanged query baseline lines 342–352 precedes scratch allocation. Reference counts are charged before Index vectors/maps are allocated at baseline lines 428–449. Duplicate folded keys still refuse the entire Index.

Minor documentation clarification: unchanged source_symbols.rs:338–340 says scratch strings “cannot scale beyond the admitted input bytes.” The new İ.arcadia test at query patch line 115 deliberately demonstrates lowercase byte expansion, and the notes correctly distinguish input-byte accounting from memory. Prefer “scratch storage is proportional to admitted path bytes and file count, including Unicode expansion and collection overhead.” This is not an unbounded-allocation finding or a blocker. Sent directly to the author; no frozen file was modified.

Shared walk and integration limits

• Source bytes are checked before token allocation; token count is checked before scanning the next token. Declaration admission at outline patch line 199 precedes quoted-ID decoding and alias/kind copies. Significant-token/body-end/brace-stack scratch is bounded by admitted token count, even if the declaration limit is smaller. These counters are not a claim of exact RSS or zero allocator overcapacity.
• The existing lexer and iterative declaration/body walk are reused. The new outline does not call lint, model parsing, stabilization or I/O. Original UTF-8 byte boundaries, CRLF, quoted braces and exact token spans remain intact. The EOF fallback at outline patch lines 232–236 includes consumed header text. Full scan, syntactic validity, lexical errors and unmatched braces remain distinct; a limit failure returns no partial outline.
• Repeated aliases/IDs remain represented, and query ambiguity checks remain unchanged. The query API validates span bounds and token correspondence, not independently proved syntactic provenance. Supply header roles only from the coordinated outline; a UUID appearing in a body/history/name must never be passed as AuthoredIdentity.
• App must admit the aggregate workspace before collecting per-file outlines and pass remaining budgets. Successful per-file scans do not prove include completeness. Membership, validated evidence and scope need proof for these exact bytes. Every input/provenance change must advance the snapshot key; navigation dispatch must recheck it and explicitly convert byte offsets to editor coordinates. Async dispatch, cross-file drafts, focus and back-navigation are still outside this proposal.

Independently checked input hashes

File	SHA256
.local/text-navigation-probe-20260911/outline-seam-v2.patch	2B37D404FD60BC871554CEC2FA4493063F3CC0134D13E7EA90DD1361A394EEC1
.local/text-navigation-probe-20260911/query-admission-v2.patch	F38B2D5BAB3CA6AB66B8BD865F3B01562299FB961C48C8172D39E1D35D90E329
.local/text-navigation-probe-20260911/OUTLINE-V2-NOTES.md	D79D176660992AC86CCAAD76E99A3D24CE21920CE052C6B94D5B5AA80E1A9C57
.local/text-navigation-probe-20260911/source_symbols.rs	CF82E34544CE508E446787B6335AEFE97E146EA5E7CCA0A9788DEB9097F8F7BB
crates/oa-core/src/language.rs	638F08A42E9CF4996B5D07F69B4D6F517A518369F3604D25BE1006E40E080765
crates/oa-core/src/source_project.rs	1394370BCC5908873B830C2C11312E6E1611AF41F46C4F43CA0A6BCB713BB466

Patch references above are physical lines in the frozen patch files, not applied production line numbers. Root owns integration, compiler/native acceptance and release reporting; peer956's source8/codec work remains separate.