v0.17.0 Analysis Authority Reconstruction

Status: complete.

This review owns the reconstruction of current-generation semantic analysis and editor recovery. It does not change accepted Nocter source, runtime behavior, ABI, or target semantics. Public tooling behavior remains owned by the language specification.

Primary Rule

Each responsibility receives only a complete contract supplied by the responsibility that owns the represented decision. A failure may retain the deepest completed semantic stage, but it must not transport a rejected production-success value, expose a builder, or require a consumer to select among parallel representations of the same stage.

The failure classification and the completed semantic stage are independent facts:

current source generation
  -> diagnostic outcome
  -> deepest semantic authority: none | declarations | names | bodies | checked
  -> target outcome: unavailable | failed | ready

A syntax failure does not erase valid declaration or name facts. A target failure does not erase a completed checked program. Retaining either fact never changes the failed generation into a successful compilation.

Boundary Inventory

Findings

A1 — Syntax Failure Erases Independent Semantic Recovery

AnalysisSnapshot selects the syntax-failure branch before the ordinary recovering session. The editor-only path calls non-recovering declaration lowering and non-recovering checking preparation. A body syntax interruption combined with an unrelated declaration or name rule therefore retains no semantic authority. The same generation also publishes only syntax diagnostics.

A2 — Target Failure Erases Checked Semantics

The session completes CheckedProgramOutput, separates its program and source projection, and then maps standard-package, primitive, target-capability, and target-program failures through a helper that always stores no recovery. These failures cannot invalidate completed source semantics.

A3 — Mutation Capability Is Not Closed

Failed-generation rename selection uses retained semantic bindings, but root-source ownership still uses a success-only unit accessor. Speculative rename validation checks entity and range equality without first requiring a checked candidate. Code actions instead require a target-complete candidate. Mutation safety is therefore selected separately by each feature.

A4 — Internal Diagnostic Projection Can Retain Recovery

Declaration lowering constructs recovery before projecting a declaration violation through SourceIndex. If that projection reports an internal missing subject, the recovery survives even though its projection authority is inconsistent. This contradicts the documented failure contract.

A5 — Rejected Values Use Production-Success Types

ProgramBuildFailure, HeaderDefinitionFailure, and DeclarationLoweringFailure transport DeclarationProgram or LoweredDeclarations after an authored rule rejected them. The current session projects them promptly, but their types still expose production transitions that must not be legal for rejected source.

A6 — Semantic Authority Selection Is Duplicated

SemanticAuthority and completion's CompletionProgram enumerate the same checked, prepared, name, and declaration stages. AnalysisSnapshot additionally exposes stage-specific helpers. Feature additions can therefore omit one state or continue using a success-only accessor without a compiler error.

A7 — Superseded Vocabulary and Convenience Surface Remain

The parser and specification use see, but lowering still exposes includes, reciprocal_include, and directly_included; two user-facing diagnostic helps also say “included”. Recovery-only internals are publicly re-exported, and unused convenience accessors make the cross-crate surface larger than its actual consumers.

Replacement Contracts

nocter-session will own the sum of completed semantic stages because it is the first composition layer that may receive declaration-lowering and checking outputs together. Individual compiler phases will return only their own stage-specific failure contracts.

nocter-analysis will own one borrowed authority view over either that retained semantic stage or a successful target. All editor features will request capabilities from that view. No feature may repeat the state-selection order.

Mutation validation will require the narrowest sufficient success contract. Source rename and semantic quick fixes require a checked candidate; target construction is not a semantic rename condition. Native or target-specific mutations may request a target-ready candidate separately.

Rejected declaration source will be projected to a declaration-only snapshot containing exactly:

DeclarationGraph
TypeStore
SourceIndex

It will contain no FrontendBindings, accepted DeclarationProgram, or transition into checking.

Migration Order

1. 1. Introduce stage-specific declaration rejection and checked-input retention contracts.
2. Make the session return one deepest semantic stage for syntax, semantic, and target failures.
3. Replace AnalysisState with orthogonal current-generation failure and authority storage.
4. Move completion, navigation, presentation, highlights, rename, and code actions to one authority capability view.
5. Delete the old recovery sum, success-only accessors, duplicate completion adapter, unused wrappers, public recovery internals, and superseded source-visibility vocabulary.
6. Add the full failure-product matrix and mutation transaction tests.
7. Perform a second dependency, reach-through, fallback, and terminology audit before completion.

Each migration step deletes its superseded route in the same coherent commit. No compatibility adapter or second authority is an acceptable completed state.

Completion Gate

The reconstruction is complete only when:

• syntax plus declaration, name, and body failures retain the deepest independently valid facts;
• every failure after checked-program construction retains checked semantic authority;
• no internal-integrity failure retains a source-projected semantic snapshot;
• no rejected value can enter a production success transition through its type;
• every semantic editor feature selects its stage through one authority view;
• every speculative mutation requires its declared semantic or target capability before an edit is published;
• no active production code, diagnostic, handoff, or architecture text uses source include terminology;
• no superseded wrapper, re-export, or feature-local authority selector remains;
• focused failure-product tests, complete workspace tests, warnings-denied Clippy, formatting, generated documentation, and repository checks pass;
• an adversarial second review finds no duplicate authority, reverse lookup, hidden fallback, or internal-representation reach-through in the reconstructed boundary.

Completion Evidence

The reconstruction replaced rejected declaration success values with a destructive-only rejected contract, introduced declaration-lowering and checked-target retention boundaries, and moved the cross-phase semantic-stage sum into nocter-session. AnalysisSnapshot now stores diagnostic classification and semantic authority independently. One SemanticAuthority capability view is the only stage selector used by hover, completion, navigation, highlights, rename, code actions, signature help, and inlay hints. Completion's parallel adapter and the snapshot's success-only semantic accessors were deleted.

Syntax recovery now preserves independent declaration and name failures as well as their semantic stages. Non-overlapping semantic diagnostics are published beside authoritative syntax diagnostics; diagnostics caused at the syntax hole are suppressed. Declaration diagnostic-projection failures retain no source-projected authority. Target-program rejection returns the unchanged checked input, and editor-session failures after checking retain CheckedProgramOutput.

Mutation transactions now request capabilities rather than status labels. Rename validation and semantic quick fixes require checked semantics, while an unrelated target-boundary failure no longer invalidates a source-semantic edit. Failed-generation root ownership uses the current discovery unit rather than a success-only accessor.

Focused tests cover:

• body syntax plus an independent declaration-rule failure;
• body syntax plus an independent name failure;
• hover, rename planning, and code-action planning from a failed current generation;
• rejection of a rename candidate that did not reach checked semantics;
• unchanged checked-program retention across target rejection;
• absence of recovery when incomplete declaration syntax cannot form declaration facts.

The final adversarial audit found no feature-local semantic-stage selector, old snapshot target or source-index convenience accessor, rejected-value production transition, target-complete mutation gate, Machine/ARM64 dependency on semantic SourceIndex or TypeStore, or active source-include vocabulary. Recovery-only header-definition APIs and unused convenience accessors were removed from the public crate surface. Complete workspace tests, warnings-denied all-target Clippy, formatting, documentation generation, and repository whitespace validation passed on the completed tree.

A later contract audit found two narrower defects behind that completion claim: the editor body capability was still a caller-checked value, and individual operation-table builders interpreted an optional admission mode. The follow-up reconstruction replaced the capability test with distinct declaration-only and body-analysis input types, froze one admitted-operation ID set before table construction, and separated lexical container predicates from global operation tables. Rejected instances and conformances therefore retain body-local facts without being normalized as dispatch candidates. It also closed declaration build failures around their matching rejected report, centralized attachment-family identity in nocter-model, and removed the parallel post-projection declaration report.

The normalization follow-up then removed the last repeated declaration-pattern calculation. DeclarationPatternTable is the single checked representation of instance and conformance substitutions, targets, associated bindings, refinements, and retained requirements. Both lexical body assumptions and admitted operation builders consume it. Member completion receives one read-only authority view instead of depending on the private field layout of checked and prepared programs.