ARCADIA-Studio/harness/experiments/analysis-mixed-rename-plan-20260924/RENAME-PLAN-SOURCE-REVIEW.md

Independent mixed rename-plan source review

2026-09-24. No remaining blocking source finding in the repaired production draft. This is source review only: tests are still being authored; no compiler, Cargo, runtime gate, source edit, commit or Gitea action was performed by this reviewer. Parent owns compilation and acceptance.

Reviewed against accepted harness/analysis-mixed-rename-plan-contract-20260924.md (published checkpoint dc87babf, local SHA256 c5f6ede88758b958b2c52da297bd17353a7a8e8d9123c06c967029fb8401183b) and actual private base ee500908e3d77182ddd54e12524f9b6c6eb43b60, branch codex/analysis-mixed-rename-plan-956atf-20260924. The accepted contract matches the preceding critique; no concrete contract discrepancy was found.

Exact reviewed working bytes

Paths below start at crates/oa-core/src/language/analysis_source/mixed/project/ in .local/as3batch. These are uncommitted working bytes, not a claimed tested commit.

File	SHA256
ordinary_index/rename.rs	3ce74331c962abfbf63ca7f72b286405b1ca8b266335d77c71103c900cb6e9dd
ordinary_index.rs	7f30ca4eaa9cb33610a70f72d08813b24ddf0c4935fa37d6caec456394b209d6

The latter changes only module wiring. Its current extra blank line is routine formatting, not a semantic finding; any later formatting change requires rebinding that file hash. New test files and compilation are outside this production-only freeze. The implementer explicitly confirmed production frozen after the repairs below.

Findings repaired before this conclusion

1. Known edit-file attribution was lost. Initial rename.rs SHA256 effd0d2bb980347ff110647ed05557ecc0abfe6f54c9dc09e9fa2894ace90789 converted all construction errors with file: None. An edit-map entry-limit refusal at an included-file token therefore discarded known provenance and fell back to the entry/default span. Final lines14,88,102,121–123 capture Some(location.file) / Some(key.0) immediately before each selected edit insertion and carry it through Failure::index. Global target/name/namespace failures keep the honest no-specific-file fallback. The existing helper continues validating canonical file/range/UTF-8 before diagnostic slicing.
2. Calculation payload equality preceded parameter shape. Initial code compared result/body before parameter length/ordered identity/type checks. The E bound was still safe, but this contradicted the accepted shape-first gate. Final lines361–374 check length and each parameter's ID/type at the same Vec position before result/body equality.

Both repairs were read back directly. Required runtime controls should reach an included-file edit-allocation refusal with its real token span, and a parameter-shape mismatch before body comparison. No claim that those controls have run is made here.

Correctness and authority assessment

• Ownership (rename.rs:6–13,125–130,150–174): the plan consumes AuthoredMixedProject, borrows one external immutable desired Project, and owns exactly sparse changed-name and physical-edit maps. Name slices borrow the target, never another field in the plan. Accessors are read-only; no loose-parts constructor, caller Budget, legacy Index conversion, mutable map, emitter or installation authority exists. A failed construction/validation drops the entire consumed attempt.
• Whole target (:319–449): exhaustive struct patterns cover all alias/name-exempted records. Map lengths and sorted keys are compared before corresponding records, whose own IDs are also checked. Project metadata/collection identity, definition variants and non-name data, ordered parameter shape, element/relation bodies, every diagram/node non-alias field, artifacts and complete trace baselines remain fixed. Historical content is compared opaquely, never rewritten. Current PartialEq semantics apply consistently, including signed zero in geometry, ordinary real data and historical carriers.
• E reservation (:16–24): reserves the complete retained raw-expression-site count before same_project, releases after all equality vectors finish, and never traverses an unpaired target-only Expr on a variant mismatch. The complete four-root reachability/frontier proof in RENAME-PLAN-CRITIQUE.md still applies. E=0 cannot invoke Expr equality from the admitted original. The bound is conservative logical live slots, not allocation capacity/RSS, and can refuse a no-op without headroom.
• Names (:31–83,450–489): visitation covers project, definitions and scoped parameters, elements, relations, diagrams and nested nodes, artifacts and traces, matching the authenticated catalog. Only changed names are retained. Checked cumulative candidate byte lengths precede alias-character validation. The namespace set includes changed and unchanged catalog members, separates globals from each calculation's parameters, permits final swaps and rejects changed-to-unchanged collisions. Unchanged plans skip this scratch set using the admitted namespace invariant.
• Exact edits (:84–147,182–258): both complete occurrence families contribute every changed qualified target. Insertions reserve before growth and reject duplicate physical keys. Validation checks original file/target membership, changed-name membership, nonempty exact original Word token/spelling and same-file sorted nonoverlap. Rescanning both source families requires every selected key with the correct target; required-count equality excludes extra edits without another seen set. Full reference extents, markers and trivia never become replacement ranges. This relies on sealed original occurrence completeness, as specified; it does not claim detection of arbitrary coordinated corruption of that source projection.
• Current snapshot (:163–174): equality includes SourceBundle entry and the complete path→bytes map. Touched and untouched files, removed/added/renamed paths and changed entry all fail. This is snapshot comparison, not filesystem atomicity.
• Combined sizing (:259–315): a streaming merge uses canonical files and sorted edits, separately checked removed/replacement totals, then subtraction before addition. Every file contributes, including untouched files. The complete output-byte limit is checked once without a separate typed intermediate cap; unknown trailing file keys refuse. There is no lengths map or output allocation.

Storage, lifecycle and remaining gates

Equality scratch E dies before name-map growth. R retained names coexist with the Q-entry borrowed namespace set; the set is explicitly dropped before its reservation releases and before M-edit growth. Final retention is exactly R+M entries, zero occurrence slots and zero copied text bytes. Actual additional peak is max(E,R+Q,R+M) when namespace validation runs, otherwise the smaller executed phases. There are no typed Path clones, identity vectors, copied model/name strings, per-family batches, sorting buffers or extra seen sets. Refusal after a reservation leaves no reusable witness, so its whole ledger/container attempt dies together.

Planning uses immutable Budget checks only: it does not parse, charge numeric work or change frame/Usage counters. Whole-target failures use a static diagnostic rather than formatting arbitrary target payloads. File-specific validation errors use the established safe helper. Emission, reread/admission, returned output ownership and history/save remain absent, as required for this planning dependency.

Compilation must still confirm Rust borrow/type/macro details. Independent complete-map and phase-cap tests must demonstrate actual predecessor admission, namespace and M-growth boundaries, E wide/deep controls, diagnostic attribution, whole-target mutation refusals, stale snapshots, combined shrink/grow sizing and bounded-stack drop. Preserve all inherited full-suite/format failures and legacy Plan/Composition outcomes. This source review is not runtime acceptance, nor acceptance of rewritten source.