ARCADIA-Studio/harness/experiments/analysis-public-read-20260925/SOURCE-REVIEW.md

# Public mixed source8 read: independent source review

Reviewed selected root contract committed locally at `bcddaba399b27bb99ff8142b9e9498785d029e0e`, SHA256 `e0b90e2b46a0c8f0693467b0585c87cd14ba258b772201b33b501a826f50ab12`, and its three design/oracle records. Production baseline is `7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd`. Independently confirmed the exact12-file committed production/docs/internal-test diff at `042e25efc25e0b73e4a39e1e794b48f88d4765bf`; all reviewed committed blobs match working bytes. External test binding appears below. No compiler, test, executable, source edit or remote operation was performed by this review.

**Disposition: no source correctness, authority or lifetime blocker found.** Compilation, production-only lints, exact runtime oracles, doctests and stack behavior remain parent-owned pending gates. Local commits are not published deliverables.

## Authority, policy and retained ownership

`CheckedMixed` is defined beside the resolver with exactly one private resolved-owner field. Only the type and `check_mixed_bundle` are reexported through otherwise private modules. Its two accessors return immutable references; no Clone, mutable access, ownership extraction, index, arbitrary constructor or editable-compilation conversion is added. The constructor consumes the result of the actual fresh parser through complete existing resolution/admission; it never substitutes a Project or parses a second model. Original source, syntax, occurrences, expressions, ledger and static-admission evidence remain retained together.

`CarriedInput::fresh` accepts only the actual borrowed bundle and caller ProjectLimits. It derives the existing internal policy and captures exact caller policy; no public Slots/profile authority exists. `parse_fresh` selects `parse_entry_producers`, which transfers policy and passes Some(guard),true,true into the unchanged parse body. Fresh guard slots are zero. The new Borrowed guard's `_bundle` reference preserves its real lifetime when Pending/Retained variants are absent in production; it adds no owned allocation or duplicate policy. C=0 is fresh caller-owned input accounting, not release/reset of a live verifier-owned carry.

Derived bytes/tokens/references retain caller restrictions and hard ceilings; auxiliary entries remain262144 independently of final-model max_records. Exact ProjectLimits survive into traversal and final model admission. Existing token/text/entry producer checks, independent inventory reconciliation, resolver single seeding, complete validation, warning ordering and ownership cleanup remain unchanged. Full file traversal still rejects detached supplied files. Missing project/ordinary IDs refuse at the current parser token; typed/parameter missing IDs refuse at the owning typed declaration. Public-facing wording changes only schema/UUID requirement messages. Existing initial index/output-byte refusal precedes Traversal and retains its invalid_source/one-character transport; no diagnostic taxonomy or precedence is rewritten.

## Dependency boundary and ordinary callers

Production now compiles the shared parse/declarations/lower/resolve cone privately. Standalone expression fixture parsing, legacy typed-only lower adapter, index/update/write modules, ordinary-index/rename/emission/acceptance chain, pending/retained authority and fixture constructors remain cfg(test). Test-only numeric observation/cursor-end methods are gated individually. Public signatures expose no private syntax, ledger, profile or carried types.

Ordinary parse_document/parse_unit still initialize mixed=None. Their grammar, migration, ID-generation, formatter/index/updater/save and caller integrations are not redirected. Shared hooks now compile in the normal library, so production Parser layout and surrounding frames change even though None branches preserve intended behavior. The prior test-only runtime cannot qualify those frames: actual non-test integration/ordinary CLI and stack gates remain necessary. No depth64/typed128 change, JSON qualification switch, heap guarantee or platform claim is inferred.

Field-level non-test dead-code allowances retain accounted FileSyntax tokens/lexical owners and resolved syntax/expression/occurrence/storage/static-admission evidence. They do not suppress a module or struct, change accounting, add fake reads or expose lint-only APIs. The initially unnecessary State.lexical_owners allowance was removed after review because that field is actively moved/read. Exact additional compiler findings must be assessed individually rather than preemptively widening suppression.

Documentation accurately limits the feature to a complete-bundle explicit-ID Rust checker. A missing reST section separator was corrected; the generated HTML diff is the same bounded17-line section, with broader conformance content retained. Three rustdoc examples share valid real public imports/source: one positive execution and two compile-fail cases force later witness use after attempted source mutation or destruction. This avoids nonlexical-lifetime false negatives; actual rustdoc must establish those compile outcomes.

## Test and oracle fidelity

The new internal bridge test invokes the exact production fresh helper and observes Some(Borrowed), zero slots, both producer inventories, all derived/caller policy fields and their hard ceilings. It distinguishes internal entries262144 from caller model records1, then checks whole empty model/warnings and legacy Usage/numeric parity without mutating a live policy. This is constructor-wiring evidence, not a public producer-cap refusal. Existing discriminatory private producer tests and298 old library tests are untouched.

Independently read the external ten-test file, formatted SHA256 `f0404325dcdecb0da5167d3a1d10cce81be10c8f9dfc8067d6cda7cd73c6e15b`. It invokes only the public checker/model APIs. Parent-authorized reuse of `model_oracle.rs` via a path module imports independently constructed public model values; it does not import a private parser/writer/index or enable cfg(test) in the linked library. Substantial OA/SA two-file fixtures match that existing whole-model oracle, deliberately reverse textual call arguments, preserve nested Work ownership and vary Unicode/CRLF. The explicit SA System prevents an unrelated missing_system issue. Receive/Dispatch UUID order supports both allocation warnings followed by both behavior-coverage warnings; complete located warnings are asserted, not assumed empty.

Separate whole-model literals cover scoped parameter IDs reused across calculations and the project UUID, ordinary nested-parent parity and exact Unicode span76..141/line2/column60. Negative cases remove each required ID class from otherwise valid input and distinguish early syntax from resolver full-span diagnostics. E78/77 and chain132/131 are correctly input-byte controls; files3/2, edges2/1 and depth2/1 use distinct actual limiter locations. Nested final records4/3 admit both declarations before model refusal; graph1/0 and reference1/0 are separate checks. Path/cycle/detached, malformed expression, duplicate globals/scopes, unresolved/wrong-domain references and long-form refusal preserve full input bytes. Exact diagnostic/model expectations remain hypotheses until the real normal-library integration run; source review found no concrete setup or privacy blocker.

## Reviewed production/document hashes

| File | SHA256 |
| --- | --- |
| `crates/oa-core/src/language.rs` | `990b7f3a4eb7a2b9b8463ac237d7b95446dbdc04da5b053098428f5ecb12937f` |
| `crates/oa-core/src/language/analysis_source.rs` | `f287f066e7b947f8bf65b25595a3002296f5b4e1b51d47ed0496541d758f8fb0` |
| `crates/oa-core/src/language/analysis_source/budget.rs` | `559378e7fa3ef2a10dc739e7316a552e61bd0d7fe4497c914f2acc5c33389124` |
| `crates/oa-core/src/language/analysis_source/cursor.rs` | `23ee53f926b4d2cb7b25a2db8f2ed01cf219ef688cb8768dbe81e115f4ffadcd` |
| `crates/oa-core/src/language/analysis_source/lower.rs` | `c03a1c3639c0d506b5ed92ecb27887c302f17c5286061450518bd2acb9bfea8e` |
| `crates/oa-core/src/language/analysis_source/mixed.rs` | `d1ccafcefb2e2c90fd79b30b44ca6566f25ed14ea954c2ebf0e30fec54bf9830` |
| `crates/oa-core/src/language/analysis_source/mixed/carried.rs` | `5ad965ca219bf70747f412a430fb391caf411023e81f4849bcf512967fbb4f23` |
| `crates/oa-core/src/language/analysis_source/mixed/carried/public_read.rs` | `4529442687f12038821bf3482123ceacd37ae6b5beed3e2343e7a6bc6128afbe` |
| `crates/oa-core/src/language/analysis_source/mixed/project.rs` | `9a1f122b8463eeee41a8455517a9c898a676678ab8e40676a97c71724910ef75` |
| `docs/language.html` | `a09757e1fa74d97165510e743a92726edd930a4744fae7a1302239b46ba7a66a` |
| `docs/language.rst` | `7babf10e5db51cecdcedd0d6246b2191a7d6bdfb3090cbe29a5805c3f62e28b6` |
| `harness/analysis-public-read-implementation-20260925.md` | `b5f437af4c6694d1b35dc0def912f846d5908cfd678d665eed609d21b972e0bd` |

Compiler/runtime acceptance is pending; there is no unchanged-stack or production-lint-clean claim from this source-only binding.

Final combined source binding: independently confirmed clean HEAD `ddf823a3d358050b3aedc711f6ec04669e59e772`. Its only delta from042e25ef is the external integration test file with exact reviewed `f0404325...` SHA256 above. All production/docs/internal-test bindings remain unchanged. The combined13-file checkpoint is source-review ready for parent-owned compilation; no runtime result is implied.

## Actual non-test compile failure and narrow repair

The first ddf823a external integration listing stopped at compilation with E0063: `language/semantic_source.rs:191` initialized the shared Parser but still gated mixed:None under cfg(test). Initial source review missed this separate initializer. The raw log SHA256 `3acdd5b0cf1dbd40c08c7e1c6feacd582ac152f3e911018223551d4e718aba51`, receipt, inputs and launcher remain preserved as a genuine compile failure; there were no tests or artifact/list results.

Independently confirmed clean repair commit `8555e417ee840e681b55ba355fc359aac00db01d`. Its only code delta removes that cfg attribute so the ordinary semantic-facet row-key reader supplies mixed:None in production; the implementation note is the only other changed file. semantic_source.rs SHA256 `4040e93cb407813468fe757b1a6336a8ac9249f2d5d70b22ff56cb79a590b3f1`. Inventory of Parser initializers confirms language.rs ordinary entry points and mixed.rs are already coherent; language::legacy's initializer belongs to its distinct Parser type. No authority, parsing policy or test oracle changes. This fixes the concrete source omission; repaired compilation/runtime remains parent-owned and pending.

## Actual external passes and final warning-only binding

Read the actual8555e4 external-suite log: all ten authored tests passed, with compilation warnings about unused Budget::limits and the redundant language self import shadowing a public glob. This finite normal-library success does not imply subsequent full/lint/doc gates passed.

Independently confirmed clean successor `bab6f96a5b05b37f2b5d67a430aed0f67d783e73`. Exact8555→bab scope is Budget::limits receiving cfg(test), external test import dropping only self, and the implementation note. All actual limits-observer callers are fixture/test/edit-chain callers; the live public parser reads its policy directly, so no runtime policy or authority is removed. The test's model/byte/diagnostic expectations are unchanged. Final budget.rs SHA256 `86b960ef3cc7aadab2deff4163c843da2f214c1571cdf440331025e75e0320b6`; external test SHA256 `a3be9489c3c038ddae76923046c12eb9e09dcddb35a52b531d661130441225e3`; note SHA256 `154384778c38d03ca866c3e7b630f34cebac99bbcbfc70a9d3d2f503c4fa9d0a`. All other previously reviewed hashes remain unchanged. No source-review blocker; final runtime evidence is a separate pending audit.