11 KiB
Independent syntax text producer source review
2026-09-25. No concrete semantic blocker found in the frozen production draft against baseline 8d52dab97c92cc31baae9f20d8c324b55818aa5d. Selected contract: harness/analysis-text-producer-contract-20260925.md, SHA256 932a44001502bcbb83807d6830956086a4b55c08fda718bf2e938c19bc6c166f. This is local-only, pre-compilation source review; tests were still being authored. No build, runtime, formatting, publication or final acceptance is claimed.
Paths below are relative to crates/oa-core/src/ in .local/as3batch.
| Frozen file | SHA256 |
|---|---|
language.rs |
e46a59993e9bc806f30a24bcd762d9ced92636d9c36cf185d9624af129899f9b |
language/raw_tokens.rs |
179e177311f753312f3e0966354d7b5e7b23a1f8a045f4e07a33582d0467229c |
language/analysis_source/budget.rs |
95191dd05669ad6c8e1b47a31876510f626c8435cb7459312fe3688a0d0e17f5 |
language/analysis_source/cursor.rs |
d45b0dc319d4aa073b3fd2d49359cf9ca6964d215c32c6f98f19f291eaa697b4 |
language/analysis_source/declarations.rs |
ad0b73a900a9d4c37662a7bd8b954bb362f13ce739a62498e18fbafc30011f2f |
language/analysis_source/lex.rs |
3409b361316a77974439b359f6784ef530998e68b7310feefe029d84ebc30328 |
language/analysis_source/mixed.rs |
dae92efc827b238f9b7cabbce39d26d0b5839274a0340136112ec5c47c5cd02b |
language/analysis_source/mixed/carried.rs |
88e9e374eda416eb3dfd110edab8d60c9d26692f8eed66983f6445c10f2bffab |
language/analysis_source/mixed/project/accounting.rs |
145ca6bb8b5f8b8e0d87cfe2cf074d11973c62f274a774c07ca04ac7e70a865b |
Authority, modes and arithmetic
carried.rs:93 consumes the existing sealed input, deriving bundle, exact policy and guard together. Only this fixture route selects stronger text mode; existing carried and ordinary entry points pass false. mixed.rs:294 derives C.text from the guard and enables scalar Budget state before scanning. Explicit borrowed C=0 remains stronger mode. No production retained-output constructor, mutable policy reset, extraction or accepted-output authority is added.
budget.rs:83 checks every component of C+T+W+delta before changing totals. Because all components are nonnegative and the whole addition is checked, the subsequent individual counter increments cannot overflow. Refusal leaves counters unchanged; releases use checked subtraction. These methods do not alter source-byte/token/entry/reference/numeric Usage. Existing profile ceilings, phase entry checks and resolver's single C seed are retained.
Quoted decoding (budget.rs:109) reserves raw payload P before the one existing decoder. Successful D<=P transfers into provisional owned text through checked T+D and W-P calculations, with no allocation or fallible reservation between the counter updates. The prior admitted aggregate proves both operations valid; P-D is no longer counted. Successful UUID/local-key consumers later drop their provisional owned strings before refunding them. Temporary W thus represents scanner/decode reservations; final T represents only surviving inventory.
Producers and lifetimes
The shared scanner discovers closing extent, reserves P, performs serde validation once, then drops the temporary Result at the end of the is_ok() statement before the Released hook (raw_tokens.rs:143–148). The method borrows its receiver; statement-end temporary destruction supplies the required ordering. Closed malformed text can be refused before validation only in stronger mode; unclosed tokens never decode. The lexer propagates refusal immediately and does not expose its local scanner. The unchanged Iterator uses an infallible no-op hook over the same scan body; legacy token classification and malformed-token precedence are preserved by inspection.
Typed names/references reserve before to_owned (cursor.rs:77), preserving existing name validation and reference-work ordering. Typed and ordinary quoted fields route through the shared Budget decoder. All three successful UUID spelling consumers explicitly drop before release: ordinary optional identity (language.rs:1263–1265), ordinary HistoricalUuid (:1382–1384), and typed identity (declarations.rs:429–431). Invalid cases abort without a surviving syntax witness; they need no successful-owner refund traversal.
Ordinary identifiers, field keys and Word values reserve before copying. Declaration-kind text now borrows the same source slice (language.rs:1643), preserving lookup/error order. Top-level fields reserve the clone and retain both key allocations in fields and field_spans. Nested fields reserve clone overlap, then drop/refund the local original (:1288–1301). Duplicate-field rejection and duplicate-description guards remain in place; no successful nonempty overwrite is hidden.
Projection (language.rs:1062–1105) recursively preserves the established traversal and positions, reserving each key/reference immediately before its clone. Previously constructed child projection values remain charged while later parent keys are copied. Quoted AST payloads are not cloned into Atom projection; HistoricalUuid copies only Id. Across files, the single Budget retains earlier-file T during later scanner/grammar/projection work. Include traversal and duplicate-name coordination copies remain excluded domains as selected by the contract.
Independent reconciliation and pending evidence
The table incorporates three parent-requested pre-compilation refinements, independently read back: quoted transfer now uses direct checked counter updates instead of release/re-reserve; the scanner comment correctly describes statement-end temporary destruction; the lexer callback explicitly fixes its Error type. These are not runtime repairs. Remaining production files match their initial frozen hashes.
Successful syntax asserts W=0. Resolution's existing ledger starts with C once (mixed/project.rs:445); accounting transfers known T once (accounting.rs:244–253). The original complete inventory walk remains independent, adding checked String lengths to a separate scalar instead of reserving T again. Its bounded work frontier and lower-node/argument/reference counting remain intact. A mismatch is an error, never a corrective subtraction. When producer mode is absent, the old progressive text reservations remain unchanged.
Parent gates must still establish compilation, all independent peak/refusal oracles, complete Project/Usage parity, legacy malformed-token behavior, exact prior phase caps, full inherited outcomes and strict Clippy. Adding Option enlarges Budget; the shared scanner/projection helpers also change native call layout. Existing 128 KiB controls and actual relevant prologues must be checked without enlarged workers. The separate post-emission baseline frame observations belong to this forthcoming packet, not the already frozen emission archive.
This review covers logical retained syntax String lengths and named temporary results only. It makes no guarantee for decoder internals, Exact/BigInt allocation, allocator capacity/RSS, other scratch, entry/metadata producer timing, or universal native stack safety. No source edits or compiler/runtime tools were used by this reviewer.
Final formatting and fixture-observer supplement
Read back the parent's final targeted formatting and two disclosed fixture-only additions. No new source blocker. The shared producer/scanner/projection/accounting operations remain as reviewed above; earlier line references refer to the pre-format snapshot. carried.rs wires #[cfg(test)] mod text_producer. New project.rs::text_producer_inventory accepts only immutable ParsedMixedSyntax, initializes a fresh local Ledger from that witness's actual carried guard, invokes the existing accounting::syntax walk, and returns scalar Slots. It neither mutates the witness/Budget nor installs, consumes or fabricates an accepted owner. It can check the inventory of semantically unresolvable syntax; that must not be described as successful model resolution. This test observer does not change production's once-only C/T transfer.
Final production hashes supersede the initial table for the compile candidate (paths retain the same prefix):
| File | SHA256 |
|---|---|
language.rs |
ad353193df7884e327229b2e0a0c3f6b5e46ed32588ed81d3228d315807b2323 |
language/raw_tokens.rs |
c6c4d390406d50c41a81262b5f642dfd3f19c51741c0a624032cfce24f4e7223 |
language/analysis_source/budget.rs |
12a925068207445441b2499c885c05b2477d7e27ebb9730de2e560ef9d0c725f |
language/analysis_source/cursor.rs |
d45b0dc319d4aa073b3fd2d49359cf9ca6964d215c32c6f98f19f291eaa697b4 |
language/analysis_source/declarations.rs |
ad0b73a900a9d4c37662a7bd8b954bb362f13ce739a62498e18fbafc30011f2f |
language/analysis_source/lex.rs |
668c71cd8789b6c92980fd18b584999078d64c2b8a9927c5c22877cb591c55f1 |
language/analysis_source/mixed.rs |
2e43116cfee79d144735e1f7f4f2b0736e03f43146d1dc6a3edbfa4309168ae3 |
language/analysis_source/mixed/carried.rs |
c1df3847f2fbc935ecab2207cbac7b20e9a055c6858d3ae5506b20dee9b44989 |
language/analysis_source/mixed/project/accounting.rs |
20590ce1bd5c4166fb2475820686228ef84a17b2fda5dc9d43c128063f46a35e |
language/analysis_source/mixed/project.rs |
8d28de967b3cc3ae4b680e13ed07a661b1d1fb133d21b85c3b4a0b9127266a61 |
Bound ancillary files: new language/analysis_source/mixed/carried/text_producer.rs SHA256 7b484b7356c48944ce3d1b1fc0e057b79bcfc643a2387978288de4305b381f20; worktree harness/analysis-text-producer-implementation-20260925.md SHA256 06b3d4c06f2788584a148472e36e25f0187ece111ddcbf7aed018a7b3a9425a0. These two hashes record the delivered candidate, not an independent test-oracle review. Compilation, runtime, frame measurements and publication remain pending/separately owned.
Committed Clippy repair supplement
Independently inspected 6b0ef99eca6f82a93e2cfc9eb16185c4f12403a7 to 97a8703adc75467a7f8e75f5c6cb00ca542b707c; final HEAD matches the latter and the worktree is clean. Only language.rs and the implementation note change. No source blocker.
The cfg(test) ordinary quoted consumer now reads the current token span before directly matching &mut self.mixed with if-let, replacing is_some/as_mut/expect. Span lookup is read-only; token-class rejection still precedes it. The selected raw source slice, one quoted_text call, error propagation, subsequent cursor increment and nonmixed decoder fallback are identical. The nonmixed test path performs one additional read-only span lookup; non-test builds remove both new cfg(test) statements. No text reservation/refund, limits, test or owner operation changes.
Superseding SHA256 bindings: crates/oa-core/src/language.rs = 8b5ee7a70ac1536d92b75f244e4d0b28e1371b0afd254e42b7775e9bdc73ae5d; harness/analysis-text-producer-implementation-20260925.md = 02c4c15a5f74e344a299f81cde976a87c94a640b7035a7f2bcde51e71011f5c9. All other nine production hashes in the final table above were rechecked and remain exact.
The parent reports six focused passes, a completed 259/16 full run and passing existing stack controls for the initial candidate, with strict Clippy failing on unnecessary unwrap. The note preserves that initial failure and requires successor gates. This narrow review did not rerun or independently audit those runtime records and does not transfer runtime acceptance to the successor. Final gates and publication remain separately owned; source publication is currently blocked by the reported server disk-full condition.