v0.18.0 Phase 3 Final Review

Result: complete after two reopened adversarial reviews (2026-08-27). The initial implementation at 21b1045d and the first reopened result were reviewed again rather than treated as permanently closed. The repairs corrected authority ownership, generation-bound editor input, specialization state, persistent iteration, repeated structural analysis, and enforceability of downstream boundaries. Phase 3 changes no Nocter source-language or runtime contract.

Review Scope

The review traced every type interning, copyability memoization, closure construction, body rejection, recovery retention, member-completion query, concrete specialization, and downstream type-consumption path. It specifically searched for rollback remnants, complete-store copies, authority components that could be paired across generations, downstream transaction access, persistent-storage leakage, repeated semantic selection, and nested mutable values that defeated structural sharing.

Findings and Remediation

1. 1. The first persistent implementation allowed a member-completion session to rely on a caller convention that each session belonged to one authority. The session now verifies the exact type and copyability bases on every use and rejects cross-generation or cross-interruption reuse.
2. Target retained one unused public helper that accepted TypeTransaction. It was removed; concrete specialization remains owned by checking's ConcreteDispatchResolver, and Target receives only immutable specialized identities plus the final descendant TypeStore.
3. The first body transaction coordinated three components but the accepted components still traveled as separate pipeline variables. BodySemanticAuthority now owns each accepted type/copyability/closure generation as one inseparable value and is the only base from which a body transaction can be opened or committed.
4. Closure requirements initially lived in a mutable Vec inside a path-copied closure value. Repeated additions therefore cloned the existing list. A closure draft now shares one immutable definition core and appends requirements to a persistent sequence; final checked closure construction linearizes the sequence once.
5. Introducing the storage crate correctly failed the existing reviewed-dependency test until its new lowest-layer dependency was declared. New executable gates now permit direct nocter-persistent dependencies only in model and checking and reject transaction or persistent collection use in Target, MIR, Machine, and runtime production source.

The reopened review found that those remediations were necessary but not sufficient:

6. TypeStore still carried lineage and exposed transaction(). A cloned mutable store could therefore represent different contents under the same authority identity, and a downstream consumer of CheckedProgram::types() could open a semantic branch. TypeStore is now a pure read snapshot. TypeAuthority exclusively owns lineage and branch creation; checked and executable contracts never expose it. 7. BodySemanticAuthority was dissolved after body construction, leaving cleanup, final copyability closure, recovery, checked programs, member queries, and specialization to carry type and copyability independently. SemanticAuthority now owns both for the whole checking lifetime. Body authority adds closures temporarily, and concrete dispatch plus destruction use one composite specialization transaction. 8. Checked member completion accepted a caller-assembled receiver TypeId. Session validation protected its memo state but did not prove that the context IDs came from the same generation. The checked API now accepts a body-node identity and derives the receiver type from its own checked body. Recovery continues to use interruption evidence frozen with its semantic authority. 9. Persistent-vector iteration performed a tree lookup for every element, final copyability closure repeatedly scanned the complete type store, and storage/concreteness queries repeatedly walked type graphs. Iteration now walks each tree node once, copyability advances over only appended identities, and both structural properties are fixed once at type interning. 10. The model publicly exposed a generic PersistentArena, and closure drafts retained an empty final-definition requirement list alongside their real persistent list. The model now exposes only a storage-independent closure identity sequence. Drafts and final definitions share one immutable core and have one requirement representation at each stage.

The second reopened review found six further weaknesses in the first reopened correction:

11. Checked member completion derived the receiver from a checked body but still accepted an independent caller SourceId for visibility. CheckedBody now owns its source, checked queries derive both type and source from the same body, and recovery queries derive source from their interruption origin. 12. Prepared, body-checking, and checked carriers repeated the same stable program-wide fields, and checked output accepted semantic facts and closures as independent constructor arguments. One ProgramEnvironment now moves stable facts intact. CheckedSemanticAuthority is constructed privately only when the body authority finalizes its own closure generation. 13. Semantic access exposed its component references as public fields, while TypeAuthority exposed both an explicit store accessor and implicit dereference. Access now crosses named consume-once capability methods, and the redundant implicit authority-to-store projection is gone. 14. The downstream authority gate searched Rust source text. Aliased imports could bypass it, while comments or test-only spelling could trigger it accidentally. Workspace Clippy now resolves the actual Rust types and denies authorities, transactions, closure construction sequences, and persistent collections outside reviewed owner boundaries. Declaration and lowering exemptions are limited to their program/type-construction modules. Manifest tests retain dependency direction checks. 15. Copyability used a logical suffix cursor but implemented it as iter().skip(cursor), so it still traversed the closed prefix. TypeStore::iter_from now begins at the exact type identity and visits only appended values. 16. SemanticAuthority::seal was restricted to preparation, but its test helper implemented Default in production builds and therefore left another empty-authority constructor available across checking. The implementation now exists only under cfg(test); production has one sealing boundary.

No open correctness or architecture finding remains after those remediations.

Final Authority Shape

Prepared/checked SemanticAuthority
    |-- TypeAuthority -> read-only TypeStore
    `-- CopyabilityTable
            |
            `-- BodySemanticAuthority (+ ClosureAuthority)
                    |
                    `-- BodySemanticTransaction
                            |-- TypeTransaction
                            |-- CopyabilityTransaction
                            `-- ClosureTransaction
                    |
                    `-- CheckedSemanticAuthority (+ finalized ClosureTable)

Prepared/checked ProgramEnvironment
    |-- declaration and implementation facts
    |-- body, destruction, and standard-role facts
    `-- exact source-access authority

Success consumes the transaction into one descendant BodySemanticAuthority, then preserves its SemanticAuthority intact through completion and checked output. Rejection drops the branch or freezes only the exact semantic branch needed by member recovery. Outcome repair retains a closed TypeProjection; other interruption kinds retain selected semantic identities only. No accepted authority is mutated and repaired.

The dependency-free nocter-persistent crate implements the private 32-way vector and AVL map. Model owns semantic IDs and type interning. Checking owns copyability, closure, body transaction, and query-session policy. Target and later layers know only immutable contracts.

Performance Qualification

The table below records the initial rewrite measurement; it is historical evidence rather than a measurement of the reopened correction. Measurements used the same machine, Cargo test profile, and temporary target directory. Each analysis scenario used five process samples; the repeated-completion fixtures performed 500 queries after constructing one generation. The recovery batch ran its two-error fixture in 100 processes per sample. Temporary source and build output were deleted after measurement.

No measured median regressed by five percent. Process-cold outliers did not affect the reported medians.

Structural Evidence

• TypeStore, CopyabilityTable, checked ClosureTable, and recovery products expose immutable read contracts.
• Structural forks clone persistent roots in constant time; updates copy bounded tree paths.
• Exact-base authority identities reject foreign and stale sibling commits without affecting semantic identity or deterministic debug output.
• Rust source contains no body checkpoint, mutation journal, rollback API, or old closure builder.
• Recovery and query code contains no complete type or copyability clone; immutable clones share roots.
• Repeated checked and recovery completion tests return identical results, while the accepted type count remains unchanged.
• Existing multi-error and declaration-order tests retain independent failed bodies and deterministic semantic results.
• A read-only TypeStore cannot open a transaction. Type and copyability branch state is owned by one SemanticTransaction in body checking, completion queries, and concrete specialization.
• Checked completion cannot accept a raw receiver type from another generation; it resolves the receiver and visibility source through its own checked body authority.
• Type property reads are constant-time, copyability completion is monotonic over appended types, its suffix iterator does not traverse the closed prefix, and persistent sequence iteration is linear in visited nodes and values.
• Stable program facts have one owner, and the checked semantic/closure pair has one private construction boundary.
• Production checking has no default or public component-pairing constructor for semantic authority; preparation owns the sole seal operation.
• Type-resolved warnings-denied Clippy rejects prohibited construction and persistent-storage types even when a downstream module renames an import or uses a fully qualified path.

Conclusion

Phase 3 meets its completion gate after two reopened reviews. The final design has one accepted SemanticAuthority across the complete checking lifetime, one body mutation capability that adds closure construction, one stable ProgramEnvironment, immutable recovery and checked products, generation-bound query input and state, and type-resolved downstream boundaries. The rewrite does not retain a compatibility adapter, a component-paired semantic branch, or a second semantic authority.

Verification

The final tree passed:

cargo fmt --manifest-path development/compiler/Cargo.toml --all -- --check
cargo clippy --manifest-path development/compiler/Cargo.toml --workspace --all-targets -- -D warnings
cargo test --manifest-path development/compiler/Cargo.toml --workspace --quiet
node docs/build-docs.js
git diff --check