ARCADIA-Studio/harness/experiments/analysis-entry-producer-20260925/SOURCE-REVIEW.md

# Independent retained-entry producer source review

2026-09-25. Reviewed frozen production against baseline `97a8703adc75467a7f8e75f5c6cb00ca542b707c` and selected contract SHA256 `0dd194e155f3ea3b6795601e199c2a63d7edff7644f3a75942801f7329a1751c` (`harness/analysis-entry-producer-contract-20260925.md`). This is local-only source review, before compiler/runtime gates. Test authoring remained in progress.

Initial frozen files, relative to `crates/oa-core/src/`:

| File | SHA256 |
| --- | --- |
| `language.rs` | `eba0d326f70a90ff1ff3097b927dfa3d3efd49b3cf56a0cc55ac14c35d93f248` |
| `language/analysis_source/budget.rs` | `f1f3571fac2b6e3891c7d02a3ea1a513122ca3259afbe28fc17315c1c4db2847` |
| `language/analysis_source/mixed.rs` | `cab97109e90e51eea690b3579b38faf1cd697244941485bbd851e415b60b25ea` |
| `language/analysis_source/mixed/carried.rs` | `0d0f44264a3f1dbc8d80b861c7156ab71bac36cecd86ee4a77ecddfe22f1f5a9` |

## Resolved internal latch finding

`Budget::producer_entry_overflow` initially replaced `failed` unconditionally, unlike aggregate checks which first call active(). A direct internal control can latch a limit error and then overwrite it with an overflow error. Recommended narrow repair: return the existing error when present. All actual parser callers propagate their first error immediately, so this is an internal sticky-error consistency finding, not an observed successful-parse bypass or runtime failure.

Parent-authorized repair independently read back: the helper now returns a clone of the existing failure before constructing/installing overflow. Final `budget.rs` SHA256 is `573636cbe24f9aadfbba1e68625fd9d861ace26c7c85b5b6530c53085e3baf4f`, superseding the initial table's budget hash. All other three production hashes were rechecked and remain exact. The finding is resolved; no remaining concrete source blocker was found. The implementer reports a dedicated internal regression assertion, whose execution remains pending.

## Prospective accounting and authority

The new fixture route consumes the same sealed CarriedInput and derives actual bundle, carried guard and exact inherited policies together. It selects both text and entry producers even for explicit C=0. Existing legacy, phase-only and text-only callers select entry mode false. No mutable policy, arbitrary public baseline, owning wrapper or accepted-output route is introduced. The private parse_impl boolean combination is supported by its current controlled callers; no caller enables entries without text/guard authority.

Existing text/guard and total-source-byte checks run first. C.entries and initial M=F are checked and installed together before Traversal construction. Failed installation leaves optional entry state absent. Budget::entry retains its existing U-only work/active check before the aggregate C+U+M+1 check; U increments only after both pass. reserve_metadata checks the whole prospective total before changing M. Checked aggregate sums prove its subsequent M += delta cannot overflow. Usage remains U alone, with no new token/reference/numeric events. The original nonlatching phase-check helpers are unchanged.

The disabled reserve_metadata path is an exact accounting no-op: it neither calls active(), changes counters nor adds failure precedence to old routes. All production calls to fallible reserve, projection counting and projector operations propagate immediately. In particular, a value-end refusal exits value() before its projection counter; an owner refusal exits before its seven-slot pending count or declaration insertion. No partial witness escapes.

## Named producers and independent reconciliation

State now hides value_ends and lexical_owners from the ordinary parser. Its value_end helper checks key presence, reserves only a new key, then inserts; repeated keys replace the existing endpoint without another M entry. lexical_owner reserves before push and counts occurrences rather than unique IDs. Actual source search finds the only mutations inside these helpers. Their reserved counters match actual map/Vec lengths after every completed file.

The plain reserved_values/reserved_owners increments are bounded, including when entry mode is off: each successful ordinary value/declaration has an earlier unchanged Budget::entry event; unique successful value offsets and owner occurrences therefore cannot exceed U, which is bounded by the candidate hard entry ceiling (262,144). A repeated map key does not increment. In stronger mode the admitted M bound also applies. They do not approach usize overflow through accepted input. Artificially corrupting those private counters is not real provenance.

Checked pending projection grows only at the three grammar sites: seven per ordinary declaration, one per completed field, one per completed value. Project headers/includes/descriptions bypass those sites; nested fields and values naturally contribute once. The seven declaration envelope includes its synthetic body and remains seven for a node header. Failed duplicates abort the entire parse, so no successful replacement/refund is hidden.

The stronger projection boundary atomically reserves significant-token count plus pending projection before constructing ends/headers/fields/values. It does not call the old borrowed-work Vec count. Other modes retain that existing counting path. The scalar prepaid quota consumes seven before header/declaration growth, one before each field and one before each actual value, before recursive children. Synthetic bodies are covered by seven and do not consume an extra value slot. Quota underflow/leftover returns an explicit invariant error; quota consumption never charges or refunds M. Token-end slots are charged once, separate from the existing significant-token storage bound.

After each file, actual map/owner lengths plus token count and quota-reconciled projection count must match the Budget M delta. The independently accumulated metadata field must equal total producer M at syntax completion. File-record moves preserve F rather than adding a second reservation. Existing resolver code is unchanged: seed C once, then reserve U+M once in its distinct ledger; text transfer/reconciliation remains unchanged. No combined seed followed by duplicate syntax addition exists.

## Legacy behavior, stack and pending gates

Without entry mode, grammar projection calls do nothing, quota is None, and the original token-end/value-map/owner/projected metric and phase timing remain. Shared projection retains its traversal, text hooks, spans and identity checks. A new forwarding wrapper and scalar fields do alter native layout even on old paths; no unchanged-stack claim follows from semantic equivalence. Parent must measure Budget/State/projector generic frames as well as prior active parser/wrapper frames, and run all old small-stack controls without allowances or test changes. There is no new heap-backed owner or generic visitor framework.

Compiler/privacy/borrow checks, independent real cap and span oracles, quota/overflow/internal controls, whole Project/Usage parity, old diagnostic disposition, strict Clippy and format comparison remain pending. This review neither runs nor substitutes for those gates. The retained logical metric excludes allocator capacity, physical file-table overlap, traversal/open-declaration/delimiter/Pratt and duplicate-name scratch, numeric/decoder internals, model/validator heap and native stack. Actual emitted-output verification and accepted ownership remain open.

## Committed replacement-helper repair and final source binding

Independently read back production committed in `a629ae01d49bb3cb482a047eb41832ad4246a5c6`, unchanged in current clean HEAD `29417130c71f70c4eaefe8ed4c879efba78eb72c`. The latter changes only the new test file and implementation note for the reported compile-time Debug-bound issue; it changes no production operation. No compiler or test process was run by this reviewer.

The second internal latch finding is resolved: `State::value_end` now computes whether its key is new, always calls reserve_metadata with delta 0 or 1, and only then increments its new-key counter and inserts/replaces the endpoint. Enabled delta-zero admission calls active() before mutation, preserving the original latched failure and existing map even for replacement. New keys still reserve exactly one M; replacements reserve no additional M. Disabled old modes still receive the same no-op budget hook and preserve their previous accounting/diagnostic behavior.

Final `mixed.rs` SHA256 is `6db2e6cc414becd32d80868653651e31de3036a6d8bf63a2c7b0c055ca7cc314`, superseding the initial table. The other production hashes were independently rechecked: language.rs `eba0d326f70a90ff1ff3097b927dfa3d3efd49b3cf56a0cc55ac14c35d93f248`; budget.rs `573636cbe24f9aadfbba1e68625fd9d861ace26c7c85b5b6530c53085e3baf4f`; carried.rs `0d0f44264a3f1dbc8d80b861c7156ab71bac36cecd86ee4a77ecddfe22f1f5a9`.

Bounded internal limitation: State::projection does not first call active(), so a direct fault-injection caller that deliberately continues after a previous error can increment the pending projection scalar when addition fits. That scalar is grammar instrumentation, not U, live M, an allocation or an accepted witness. All actual parser calls immediately propagate earlier errors; the final budget.active() also prevents a poisoned witness from escaping. Overflow still preserves the first latched error through the repaired overflow helper. No reachable parser invariant violation or acceptance bypass was found, so no third repair is required for this prerequisite. This does not promise terminal immutability for every internal instrumentation method under arbitrary post-error calls.

No concrete source blocker remains. Exact-cap syntax tests and roomy independent counting-walk tests must remain distinct because the walk has its own transient entry frontier; this source review does not authorize changing a live policy to make either pass. Compiler/runtime acceptance and publication remain parent-owned and separately evidenced.