FileId/span integrity hardening, phase A: fix wrong-file offset binding across engine, writers, attribution, and Lua (bd-nv4p0eb1)

[cscheid]

What

Phase A of the FileId/span integrity hardening (bd-nv4p0eb1, the systematic audit follow-up to #478): seven strands fixing every verified q2-side instance of the "splittable (FileId, offsets, content)" bug class outside the sites #478 already covers, plus a lint guardrail preventing new ones. One --no-ff merge per strand; every fix was TDD red-first.

Assessment: claude-notes/research/2026-08-09-fileid-span-integrity-audit.md
Plan: claude-notes/plans/2026-08-09-fileid-span-hardening-phase-a.md

The fixes

• bd-itj2mjkr (p1, live bug): EngineExecutionStage derived the engine intermediate's FileId from ast_context.filenames.len(), but MetadataMergeStage grows source_context.files without growing filenames — so in every project render with an executable engine, engine-produced blocks were remapped onto _quarto.yml's dense slot. Now uses the id add_file* actually returns; the executed-AST remap is conditional (FileId(0) → new_slot) instead of additive. E2E-verified with a real jupyter project render.
• bd-f6h40a9r: the incremental writer fell back to raw start_offset()..end_offset() wherever preimage_in returned None — which is precisely the foreign-file/gappy-Concat case — slicing original_qmd at another file's coordinates (wrong bytes, or a panic). All four sites (KeepBefore inlines, recursed containers, block-level Verbatim coarsening, compute_separator — the red run caught the last one panicking) now degrade to whole-block Rewrite.
• bd-t3enk8gq: caption-extended table spans in section.rs/pipe_table.rs paired raw offsets (parent-relative for Substrings) with root_file_id().unwrap_or(FileId(0)) in a hand-built Original. Both now use the same-file, preimage-based hull_source_infos (promoted pub(crate)); red tests exercised the mis-anchoring through qmd::read's public parent_source_info parameter.
• bd-vmlhw7nx: attribution gated on the raw literal file_id != 0. AttributionData now carries the blamed file's FileId; query_attribution compares typed ids threaded through the walkers.
• bd-thagcbfq: Lua si:byte_range() discarded the fid, so lookup_range(r[1], r[2]) silently misattributed include-spliced nodes. The table now carries file_id; lookup_range takes an optional third argument checked Rust-side against the handle's blamed_file_id(); the bundled lookup thunk passes it instead of hardcoding fid ~= 0.
• bd-y5gpc8yv: quarto-xml's anonymous parses minted FileId(0), which positionally aliases the primary document in any populated SourceContext. Now a non-aliasing ANONYMOUS_FILE_ID = FileId(usize::MAX) — span-less degradation, never wrong-file.
• bd-jrq4hroi (guardrail): new add-file-with-id xtask lint restricting SourceContext::add_file_with_id to blessed modules; everywhere else must use bind_config_source (Bind the correct config-source file to Q-5-8/Q-5-1 diagnostic spans (bd-m6wmztln, bd-p86nlm92) #478) or carry a reasoned // lint:allow(add-file-with-id). The red run flagged exactly the four audited sites, now carrying reasoned allowances. render_scripts.rs/project_resources.rs are temporarily blessed to avoid conflicts with Bind the correct config-source file to Q-5-8/Q-5-1 diagnostic spans (bd-m6wmztln, bd-p86nlm92) #478 — to be removed once Bind the correct config-source file to Q-5-8/Q-5-1 diagnostic spans (bd-m6wmztln, bd-p86nlm92) #478 and bd-x113wg9v land.

Testing

• Every fix verified red first (details in each strand and commit message; two panics, three wrong-bytes/wrong-file symptoms, two API-semantics reds).
• Workspace: 11169 tests pass; full cargo xtask verify green at branch head (Rust + lint + fmt + hub/WASM legs).
• No snapshot files changed.
• One unrelated flaky failure observed and filed (bd-u0tldu4z: quarto-hub admin_collect_lifecycle; no dependency edge to these changes, green in isolation and on rerun).

Relationship to other work

Independent of #478 (based on main); the remaining audit strands (bd-x113wg9v, bd-h5rfw3ao, bd-r64mj1aa) wait for #478's bind_config_source + extension_manifest_paths. The upstream API redesign (quarto-source-map/quarto-yaml, "Option B/C") is tracked in the research doc §6 and posit-dev/quarto-yaml#17.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.