ARCADIA-Studio/harness/experiments/analysis-ordinary-index-20260924/ORDINARY-SOURCE-REVIEW.md

Ordinary authored-name index: independent production source review

2026-09-24. Reviewer /root/mixed_index_source_review, GPT-6 Astra. Local-only evidence for parent acceptance. No Cargo, runtime tests, source edits, Gitea posts or commits were performed by this reviewer. Only this report was written. Tests were still being authored during inspection; this is not a test-oracle or runtime acceptance report.

Scope and exact reviewed source

Checkout .local/as3batch, branch codex/analysis-ordinary-index-956atf-20260924, HEAD/base 93eb6117f95353d25d594d59780018f197c51672. Reviewed the entire new ordinary production module and the narrow project.rs delta against root harness/analysis-ordinary-index-contract-20260924.md and its accepted critique. No re-review of the completed typed index was undertaken.

SHA-256 working-file hashes:

Repository-relative file	SHA-256
crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index.rs	F516574ABD74EA92632B63684AFA6AB38EDB8485B43ED1CA80B2A91C01DFF4A4
crates/oa-core/src/language/analysis_source/mixed/project.rs	3F6ADED6BFF521D7991C491DED3001698874FC1A667951E91941669AFA2AADD6

The implementer confirmed both production files frozen and unchanged after initial formatting; a final hash reread matched this table. Concurrent changes to parent project/tests.rs and new ordinary test files are outside this production source snapshot.

Line references below use those working files and are relative to crates/oa-core/src/language/analysis_source/mixed/. git diff --check returned exit 0 for tracked changes; the new ordinary module was untracked at inspection and is identified by its hash above.

Disposition: no concrete blocking production-source defect found in the reviewed snapshot. Compilation, independent full-set oracles, exact storage caps, corruption paths and lifecycle execution remain parent gates. This is a complete authored-name occurrence capability, not a complete editing capability or public source8 activation.

Provenance, ownership and unchanged legacy behavior

• project/ordinary_index.rs:25–40 consumes IndexedMixedProject and retains it alongside one owned map. There is no clone of its bundle, complete Project, names, typed maps, syntax or raw arenas. Construction success returns the entire owner; failure drops the consumed attempt.
• The returned wrapper's fields are private. Read-only methods (:44–67) borrow its Project, warnings, original bundle/files, qualified names and both occurrence families. It does not expose an index constructor from loose source/position/model parts, mutable replacement state, a legacy Index conversion or old-updater adapter. Public record fields are observed only through a shared map reference and do not grant authority to modify the owner.
• build (:77) is module-private. Its temporary borrowed name lookup never escapes. The result stores only owned physical keys and inline ID/role/extent values, so no self-reference is introduced. Ordinary target identity is global; scoped parameters are filtered out before reverse lookup.
• The only modification to prior production behavior is extraction of the typed constructor's existing canonical-file/UTF-8-span fallback into Failure::index (project.rs:128). Source comparison shows identical filtering, range check, default-span fallback and final Failure::typed call. The typed constructor calls that helper with the same inputs. No old Index, Plan, public source updater, grammar, parser, lowerer, formatter, admission or ordinary converter changed.

Complete name coverage and token/owner checks

• The builder enumerates only Target::Global catalog entries (ordinary_index.rs:92); each reverse-map value holds its ID and one inline seen-header flag. It visits existing typed declaration headers (:103–119) and requires their target to equal their owner. header (:267) checks spelling/ID agreement and rejects repeated global headers. The final scan (:244) rejects a global catalog member with no authored header. This covers the project, ordinary and typed declaration families while leaving parameter declaration names in their existing typed scope.
• Project header handling (:121–150) binds the header to the canonical entry path, binary-searches its original starting token, checks whole Word project, uses exactly the next retained significant token as the alias, checks containment and exact admitted spelling, then checks its global identity. No substring lexer or secondary header parser is used.
• Ordinary declarations are paired directly with their retained position entries (:154–173). The ID, full declaration span, body and lexical owner must agree. Thus nested declarations are separately owned flat occurrences; the algorithm does not assign ownership from overlapping parent spans. The alias must be the significant token immediately after that declaration's original starting token, lie before the body, be contained in the declaration, and match a whole original Word token and retained alias (:176–204).
• The synthetic root is explicitly checked against body.start - 1 .. body.end + 1, with checked arithmetic and valid source/decl containment (:207–235). It must be a Record; actual top-level fields are checked against body interior. This preserves the accepted braces exception instead of incorrectly requiring the synthetic root to fit inside the body interior.
• fields/push_field (:303, :377) walk every retained Record/List leaf iteratively. Actual field spans fit their parent, values fit their fields/list, and every popped value fits the owning declaration. References in scalar fields, nested structures and repeated lists all take the same path; there is no incomplete field-name/category selector and no reuse of active_references.
• A Reference (:321–357) must start at an original significant punctuation @, followed immediately in the significant stream by the alias Word, whose end must equal the full retained extent's end. Whole-token class/span and source spelling are checked by word (:413); the retained name must resolve in the global-only lookup. The map key grants authority only over the alias Word, while extent preserves marker/trivia/alias for inspection.
• Atom and HistoricalUuid leaves are skipped (:372). No prose, display-name, include-path, identity-string or historical UUID occurrence is invented. Implicit parenthood creates no reference, while any explicit parent @x is visited normally. Existing grammar restrictions remain unchanged.
• insert (:286) rejects a physical key present in either the typed-token set or the new ordinary map before allocation. Whole-token checking prevents partial-token overlap from becoming a separate legitimate occurrence. The map's keys are canonical file plus original Word span; repeated uses of one target at different physical locations stay distinct.

The runtime checks do not independently re-emit every ordinary reference from the raw AST. A coordinated omission from the trusted position projection is outside that check boundary, consistent with the accepted contract. Completeness is exhaustive traversal of the sealed projection plus independent full-set oracles; it must not be reported as arbitrary coordinated-corruption rejection.

Storage, frame and failure lifecycle

The implementation matches the accepted one-map representation. If D is ordinary declarations and A is ordinary Reference leaves, successful retained delta is exactly N = 1 + D + A entry slots, zero lowerer occurrence slots and zero owned text bytes. The original complete witness and all typed/source/name/raw-arena/warning reservations remain live.

• Every reverse global entry is reserved before insertion (:94). It borrows catalog name strings; its seen-header bool requires no additional set/container.
• Every typed physical key is reserved before set insertion (:110). Its file/range is checked against the actual retained file table first. Existing typed maps are never cleared to make the new construction fit.
• Every ordinary map entry is reserved before insertion (:299), after duplicate checks. There is exactly one new retained map and no copied name, source, declaration, field/path key, formatter result, or path arena.
• Each pushed field/value/list work item reserves one entry first (:367, :387). Pop releases one logical slot (:317) under the established logical-live-slot policy. The Vec contains borrowed values and inline spans, so popping adds no owned subtree or copied path. Each declaration's work Vec drains and is dropped before returning.
• On complete success, both scratch maps are explicitly dropped (:255–256) before releasing their exact G+T entries. Work vectors have already drained/dropped; no scratch reservation is released while the corresponding logical entry remains live. All reserved additions flow through checked Ledger::reserve; no fresh permissive budget or ledger is introduced.
• The actual entry peak is inherited baseline plus G + T + max over construction states of (ordinary entries already inserted + live work slots). N+G+T+Wmax is a conservative bound, not necessarily the exact fixture peak: the work maximum can occur before the last reference entry is inserted. Boundary tests must enumerate the real state sequence.
• The builder holds only &Budget; there are no parsing, reference/Exact recharge or Budget::frame calls. Parsed Usage, including deepest_frame, and numeric work therefore remain unchanged in this successor. Scratch entry checking is separate from frame usage.
• For an error, the current local file is recorded before all per-file and per-typed-location checks. Global-catalog/coverage failures explicitly use no file and default span. Failure::index preserves a valid canonical file and valid original range, resets malformed UTF-8/range spans safely, and uses the established entry fallback for unknown files. It avoids the previously repaired diagnostic-slicing hazard.
• A failed builder can leave reservations inflated only in the consumed witness that is immediately dropped; no partial map or reuse lease escapes. Builder maps contain simple IDs/spans/borrowed strings; work vectors contain borrowed pointers. No new recursive destruction is introduced. Existing retained syntax/model/typed Path cleanup remains the prior owner's lifecycle and still needs its required runtime small-stack checks.

Remaining acceptance evidence

No compiler or runtime claim follows from this source review. Parent should require:

1. Independent complete numeric header/reference maps for OA/SA, Unicode/CRLF, nested ordinary owners, explicit/implicit parenthood, canonical ordering, marker comments and both ordinary/typed target directions.
2. Additional category/shape fixtures for relations/contextual chains, views/routes, artifacts, traces and historical UUID exclusion; ordinary global versus scoped-parameter spelling/UUID collision cases.
3. Intentional corruptions reaching project marker, whole Word, Reference marker/extent, global target, owner/file, root/field/value containment, physical uniqueness, repeated/missing header and safe diagnostic checks. Later checks should not be accidentally credited to an unrelated earlier rejection.
4. Exact retained delta, zero copied-name/occurrence delta, hand-counted actual scratch peak and cap-minus-one refusal with the inherited typed baseline still present. Compare every parsed Usage field and Exact counter, complete Project/warnings/static metadata and original bundle identity/file bytes.
5. Success/late-rejection destruction on the existing small-stack harness, typed-index regression tests after shared failure-helper extraction, strict required static checks and explicit inherited suite dispositions.

The separate complete-target rename contract and compositor remain future work. Nothing here grants ordinary scalar/structural edits, identity changes, missing-ID stabilization, public source8, history/checked-save or user-facing parity.