ARCADIA-Studio/harness/release-text-navigation-outline-review-20260911.md

Independent bounded-outline source review — 2026-09-11

Reviewer: Codex-9e8r6t /root/linux_readiness, acting only as a Windows/product source reviewer. Linux remains paused under user issue 1 comment 350. Read coordination 338/344/349/351/359 and current source. No patch application, production edit, compiler, test, UI, WSL, staging or commit was performed.

Outcome: one P2 correction is required before App integration; one P3 cost improvement is advisable. The reviewed proposals and their prepared tests remain unexecuted. Source reasoning is not a compiler or runtime pass.

P2 — Header identity recognition exceeds the language's spelling rule

Exact locations: .local/text-navigation-probe-20260911/outline-seam.patch:190 retains Id::parse_str(&text).ok() in the shared walk; source_symbols.rs:419–423 repeats that permissive decoding. Production crates/oa-core/src/language.rs:1233–1244 first requires 36 decoded bytes and hyphens at 8/13/18/23. The installed uuid 1.26.0 src/parser.rs:147–158 explicitly also accepts compact, braced and URN forms.

Concrete unexecuted falsifiers substitute each literal below into oa_actor a "A" id "LITERAL" {}:

• 00000000000000000000000000000001
• {00000000-0000-0000-0000-000000000001}
• urn:uuid:00000000-0000-0000-0000-000000000001

The real declaration parser rejects each spelling. The proposed outline returns Some(Id(1)); the documented adapter zips it with id_literal_span, and query identity at source_symbols.rs:560–566 can issue a cross-revision authored anchor. A malformed header is therefore promoted to an identity that the source language does not admit. Tolerating the draft is appropriate; minting this navigation identity contradicts the intended malformed-ID contract. The proposal author confirmed that this permissiveness was inherited, not intentional policy.

Use the existing decoded header-spelling rule in a shared narrow predicate; retain the exact quoted literal span but return no authored ID for these forms. Keep Unicode escapes that decode to an admitted hyphenated spelling valid, and retain accepted uppercase hex. Ensure the trusted query adapter cannot reintroduce permissive decoding. Prepared regressions should check outline id == None, preserved literal bytes, and no authored anchor for all three counterexamples.

Compatibility decision: sharing the corrected walk changes analyze's ID result for these already-invalid headers, although its public shapes remain unchanged. Record and test that intentional correction; do not silently describe legacy analysis behavior as byte-for-byte unchanged or add a competing header parser.

P3 — Unicode path correction repeatedly folds previously visited paths

query-unicode-path.patch:10–11 correctly matches core source_project.rs:349's Unicode lowercase collision policy, including contextual Greek sigma. However, each file folds every earlier path again. With F paths, this performs F(F−1)/2 repeated lowercase allocations/comparisons; increasing loaded files can make rebuilding the index unnecessarily expensive.

Aggregate input admission at source_symbols.rs:348–352 occurs first, so this is not an unbounded-allocation or correctness claim. Prefer one folded key per path in bounded scratch storage, as core does, after aggregate path admission. No timing test or measured performance regression is claimed by this review.

Other reviewed invariants and caller obligations

• The new outline checks source bytes before token allocation and token count before scanning the next token. Its declaration cap precedes ID decoding and alias/kind copies. Significant-token/body arrays are O(admitted tokens), and brace recovery is iterative. The lexer and declaration walk are shared with legacy entry points; the new entry does not call lint/model parsing or I/O.
• Original UTF-8 byte spans and CRLF are retained. The EOF fallback at outline-seam.patch:199–203 includes the consumed name/ID token; closed-body matching retains source extent. Full scanning, lexical errors, unmatched braces and valid syntax remain distinct. Budget errors return no partial result.
• Query maps preserve repeated aliases and IDs. references_to:590 refuses ambiguous aliases; resolve_anchor:570 checks uniqueness across all loaded files, including detached copies. Snapshot handles reject changed keys.
• App must allocate finite aggregate budgets before accumulating per-file outlines and pass remaining budgets, rather than granting each file the full workspace allowance. Supply exact lexer classes and proven header roles: query preflight validates bounds, not their syntactic provenance.
• Set full-file coverage only after successful outline completion. Included membership, complete-project scope and validated evidence require independent proof for these exact bytes. Empty matches in partial scope are not proof of no project references. Every input/membership/evidence change must advance the snapshot key. Convert byte columns explicitly for editor coordinates, and revalidate revision on navigation dispatch. The outline alone supplies none of those App lifecycle guarantees.

Frozen inputs

Hashes independently read before review:

Artifact	SHA256
outline-seam.patch	40B41DFB71F0DAED322FB6B33943CE2EB529D42337E9EA945A67D1F688D6FF36
query-unicode-path.patch	6978635817B1CB36BBA82D8D45B17BB3C58316122DCC8CD4DE419D343C86A9DC
source_symbols.rs	CF82E34544CE508E446787B6335AEFE97E146EA5E7CCA0A9788DEB9097F8F7BB
OUTLINE-NOTES.md	3230D5B33F4FF29114FCACB4E2017F95630D339B88FB7AED0894AAE346A9F890
production language.rs	638F08A42E9CF4996B5D07F69B4D6F517A518369F3604D25BE1006E40E080765
production source_project.rs	1394370BCC5908873B830C2C11312E6E1611AF41F46C4F43CA0A6BCB713BB466

Root owns correction authorization, immutable test execution, integration and native acceptance. Peer956's source8/codec/lifecycle ownership is unchanged.