v0.25.0 Architecture Follow-up Review
Status: remediation and full-workspace follow-up complete (2026-09-01). This review records cross-cutting defects found after the no-allocation contract review. The findings were not noalloc semantic defects; they were authority and documentation-boundary defects exposed by the same full-workspace review.
Reviewed Boundary
The review traced declaration rejection through session recovery, executable specialization through instance-key construction, discovery topology through declaration reservation, and mutable development status through the generated documentation site. It then searched the complete compiler workspace for equivalent public reconstruction APIs, independent topology builders, and uncatalogued development records.
Findings and Remediation
Declaration-lowering recovery previously exposed a consuming decomposition into a declaration graph, type store, source-ownership table, and source index. Session reconstructed a checking-owned recovery value from those independent parts. Although the values came from one product at the call site, the public contract allowed combinations that no compiler stage had produced. Session now retains either the lowering-owned or checking-owned recovery product intact behind one private DeclarationEvidence variant. Both products publish borrowed read capabilities; neither exposes a public constructor that can manufacture declaration evidence from unrelated parts.
Executable callable, closure, and drop specialization previously accepted a TargetProgram and a specialization TypeStore independently. Correctness depended on the caller preserving the checked store's identity prefix. Instance-key construction now consumes a sealed borrowed ExecutableSpecialization capability. Only the executable closure builder can construct that capability, directly from its target and its target-derived concrete dispatch resolver. External callers can still build ordinary checked-store callable keys, but cannot pair a semantic identity with an unrelated specialization store.
Focused topology tests previously called a second public topology lowering path. That path rebuilt an AcceptedDeclarationProgram and SourceIndex independently of the declaration surface and reservation path consumed by production. The duplicate builder and its output wrapper were removed. Discovery and topology tests now validate collect_declaration_surface, the same canonical surface consumed by declaration reservation. Production remains the only path that creates the accepted declaration program and source projection.
Contributor entry points duplicated mutable milestone and review status. Some records were absent from their directory indexes, so the generated site could silently hide them. The contributor entry point now links stable catalogs instead of repeating version status. Each milestone and review file owns its own status, and the documentation build rejects any milestone or review Markdown file missing from its catalog. The adversarial generation test proves that rejection.
Residue Review
Workspace searches found no remaining lower_compile_unit_topology or LoweredTopology path, no public declaration-recovery parts constructor, and no instance-key API accepting an independently pairable specialization type store. Remaining consuming into_parts APIs either cross an explicit validated transition or separate source projection from semantic selection under a documented independence contract.
No compatibility wrapper or deprecated alias was retained. The new enums and capability token encode which combinations are legal; correctness no longer relies on a caller remembering a lineage comment.
Qualification
- complete compiler workspace tests pass;
- complete workspace Clippy passes with warnings denied;
- workspace formatting and repository diff checks pass;
- generated documentation builds deterministically;
- the adversarial documentation test rejects an unindexed review record.
No current defect or near-term structural blocker remains in the reviewed boundaries.