6.0 KiB
Independent emitted-unverified production review
2026-09-25. No concrete source correctness blocker found; compiler and runtime acceptance pending. Reviewed frozen uncommitted production over fa7a980418ef99d772e67c66c28dfa7b5181f875 against selected contract harness/analysis-mixed-emission-contract-20260925.md, SHA256 2bb0f15ee6a97ca88bc3bfa55e7ae8c830ce389ed05aee879465cd66977cd701 (published6c0d9e80). Tests were still being authored and are not part of this verdict. No source edits, Cargo, executable or network actions.
Exact working bytes, under crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/:
| File | SHA256 |
|---|---|
rename/emission.rs |
62a7252b24deaabec1b4a73d45330155e21e1f03c16c3c6baf1bedc3063289e7 |
rename.rs |
01a7955fb6daa3c1a16032db8508dc1222b4052d2bc533bf4607fb0750d5b8f1 |
The existing file changes only its module description and emission child wiring. Existing planner validation/sizing behavior and carried production files are unchanged.
Findings
- Sealed authority and branches (
emission.rs:16–45): both consuming methods compare the complete current bundle, rerun the existing complete edit validator (which includes size validation), and enforce the selected branch. No-op returns the original source field; empty validated plan maps drop without output construction. Changed emission rejects every Some carried guard, including borrowed-zero mode, before O reservation. This avoids discarding a reservation for a still-live external retained owner. - Upfront aggregate reservation (
:46–54,139–151): complete S comes from the original-coordinate size walk. O adds entry bytes and every canonical key with checked addition, uses complete F and zero lower occurrences, and is reserved against the existing source ledger already containing R+M. No output String, path key, entry string or map entry is created before this reservation. Original source bytes and desired aliases remain borrowed. No lengths map, copied edit list, extra complete buffer or heap wrapper was added. - Original-coordinate emission (
:56–108): canonical source files each get one final String; their sorted physical-key range is walked for checked size and then original-slice construction. Original untouched ranges, exact desired alias and final suffix are appended in order. The existing validator authenticates target membership, UTF-8 boundaries and nonoverlap before map indexing; immutable plan/desired authority means the laternames[target]indexing has a proved key..getguards range/tail slicing. Replacement strings and markers are not globally substituted or decoded. Untouched files still copy once. - Completeness and consistency (
:99–115): each constructed length equals its independent size calculation; checked produced sum and complete map count must equal S/F. Entry is copied once and reserved separately from its equal-spelled map key. Canonical path uniqueness is inherited from the sealed syntax/traversal; the final count also refuses a duplicate-key construction discrepancy. These are producer checks, not semantic output authentication. - Ownership transfer (
:116–136): exact Limits and ProjectLimits, original expression count E and desired borrow are captured without model/name clones. Explicit names/edit/source drops happen before Pending construction. All old auxiliary maps, warnings, syntax, model and ledger belong to the dropped source; external original source and desired remain caller-owned under the declared exclusions. Changed legacy-only admission ensures no counted external carried owner is silently discarded. Pending retains exactly O, not the temporary L+O overlap. - Lifetime/API separation (
:6–34): Pending has only the desired lifetime, owns its output and has private fields with no production getters/extraction/adoption/parser conversion. Unchanged returns only the original-source lifetime. There is no common large owning enum, Box/Rc/Arc, callback layer, general loose-parts constructor or duplication of policy inside old witness types. Actual Rust lifetime/type checking remains a compiler gate. - Failure lifecycle: existing source-bound diagnostic conversion runs while self remains alive. Aggregate failures use explicit entry/default fallback; per-file construction failures use the actual canonical file. Partial output and the consumed plan drop on refusal, with no reusable reservation or pending result. Failure-diagnostic allocations retain the existing documented reporting exception. Runtime tests must still demonstrate intended phases and locations.
No blocker or requested production repair arose in this frozen source pass. The split API avoids the specific large-outcome shape discussed in design; it does not prove debug stack-frame behavior. Retain all old small-stack source/allowances and exercise the new emission/drop path after preparing parse prerequisites outside its worker. Do not infer safety from source-size estimates or weaken existing controls.
Pending acceptance and limits
Test review must independently confirm E/H exact L+O cap pairs, complete OA/SA/global/scoped/category/Unicode/CRLF bytes, untouched-file copies, stale/wrong-branch/corrupt-map refusal, any-carried rejection with guarded no-op preservation, exact policy/E/desired retention and lifetime separation. Existing repeated sizing is allowed and does not charge parsing/numeric Usage. The original E scalar is preserved provenance, not yet a justified bound on arbitrary faulty reparsed operands. Neither this source review nor a future passing emission test accepts rewritten source, invokes carried parsing, closes parser before-growth obligations, or enables public source8/history/save.
Committed readback
Commit 19a4082117b88caf332198e4c685bde91005cb52 matches both production file hashes above exactly. The final test files are bound separately in TEST-REVIEW.md. No production repair was needed during source review; the two resolved test-fixture corrections and scoped stack extension do not alter production. This is a source/hash readback, not runtime acceptance.