v0.25.0 Query Authority Closure Review

Status: reopened ownership remediation and full review complete (2026-09-02).

Reviewed Boundary

This review followed current-generation source projection from reusable declaration materialization through checking queries, whole-program finalization, session translation, and target rejection. It also audited lower-stage public functions that could schedule work outside nocter-compiler-computation and every semantic query path that previously converted a typed failure into Option or Unavailable.

Design Change

The semantic query graph now distinguishes authored rejection from compiler-domain integrity failure. A rejected stage does not demand its downstream query, so "not reached" is scheduler control flow rather than another cached result variant. SemanticQueryFailure retains compile-input, projection, preparation, body-name, body-checking, and finalization causes in the cached query product. Session receives that same typed cause instead of reconstructing a generic missing-authority error.

Each complete/incomplete and downstream semantic query validates its own stage capability. The unit query still owns normal scheduling, but a future internal caller cannot silently analyze the wrong source state or turn a rejected predecessor into a fabricated downstream product.

CheckedProgramOutput no longer exposes a public constructor. It owns a component-preserving transform that lends the semantic program by value while retaining source projection. Target validation consumes only CheckedProgram and has no SourceIndex dependency. Success returns the target beside the retained projection; rejection restores the exact checked output pair.

Pre-query checking schedulers that had no production caller were removed from the ordinary public surface or restricted to test-api. ReusableCheckingQuery now owns reusable preparation and the only declaration recipe allowed to reopen it. The exact-current body context owns its frontend bindings and source projection; compiler computation cannot inject those pieces per operation. Complete and recovery checking entries consume intact declaration-lowering products rather than accepting their independently pairable parts.

Incomplete declaration lowering now preserves its primary typed failure together with any continuation failures. CompileSessionFailure carries that complete cause through the session boundary; no caller recreates a generic diagnostic from the absence of a checked product. Name checking rejects through its current branch instead of lending checker state to session for a second interpretation.

The exact-current body context also owns one sealed body source input. The input binds body identity, names, locator, path, and source fingerprint at construction, so body checking and recovery cannot accept independently pairable source facts or rediscover them from workspace state.

Root Cause Closed

The earlier query migration centralized the production call graph but did not fully close the lower-stage API graph. It also treated source projection's independence from semantic decisions as permission to split and reconstruct exact-current products. Finally, Unavailable combined a legitimate branch control flow with an internal join failure, erasing the evidence needed to diagnose which contract had failed.

The first correction still used public friend APIs guarded by source-text architecture assertions and Clippy method bans. That made correctness depend on callers obeying policy and omitted one equivalent declaration entry. It also moved SourceIndex into target solely to preserve a pair, leaking presentation into a semantic layer. The reopened correction replaces both policies with Rust ownership and dependency boundaries: safe query products perform joins internally, and a generic checked-output transform preserves projection outside target.

Qualification

The complete compiler workspace, all features, architecture tests, Clippy with warnings denied, formatting, repository diff checks, and deterministic documentation generation pass. Follow-up review found no public low-level checking transition, no external construction of an exact-current body context, no target dependency on source projection, and no source-text or disallowed-method test standing in for the repaired type boundary. The final failure-path and body-input audit found no erased declaration cause, session-owned checker interpretation, or independently pairable exact source input.