Now that the stack is per-invocation and never crosses a thread boundary, the Mutex is permanently uncontended — and, more importantly, the type now says the opposite of what this PR just established. Mutex reads as "shared across threads", which is precisely the property being removed.

RefCell would encode the new invariant in the type system: it is !Sync, so any future attempt to move this back onto ModelAnalyzeRule as a field, or to share it across threads, becomes a compile error rather than a silently reintroduced race. That seems worth having right before step 3 removes call_lock and real concurrent traffic starts arriving here.

Secondary benefit: the scoped block in build_model_plan_node that drops the borrow before recursing is load-bearing. If someone later widens it across the recursive call, parking_lot::Mutex (non-reentrant) deadlocks, whereas RefCell panics with a location. The latter is far easier to diagnose.

I prototyped it to make sure this is not just theory — it is a 4-line change:

type ModelStack = RefCell<HashSet<String>>;
//  cycle_stack.lock()      -> cycle_stack.borrow_mut()
//  self.stack.lock()       -> self.stack.borrow_mut()
//  use parking_lot::Mutex  -> use std::cell::RefCell

Result: clippy --all-targets --all-features -- -D warnings clean (exit 0, zero warnings, forced fresh analysis), cargo test --lib 148/148, concurrency regression still passes. No Send/Sync obstacles.

(Unrelated and pre-existing, just noting it while we are here: ModelStack / ModelStackGuard are named "stack" but the underlying type is a HashSet, which has no ordering.)

Switched to RefCell and verified the guardrail: storing it on
ModelAnalyzeRule fails to compile because the shared analyzer rule must be
Send + Sync.

I updated the documentation and explained why the mutable borrow must end before
recursive analysis and ModelStackGuard::drop. I left the stack naming unchanged
as noted.

Minor diagnostics point: because this is an assert! inside the spawned thread, the failure surfaces at the join as

analyzer stress thread panicked: Any { .. }

since join() yields Err(Box<dyn Any + Send>), which has no useful Debug. The informative message — thread 1 iter 0: valid acyclic RLAC query failed under same-context concurrency: ... — only reaches the output via the default panic hook writing to stderr. Both are visible in a normal local run, so this is cosmetic today, but if stderr is filtered or only the final failure line is surfaced, all that remains is Any { .. }.

The closure already returns Result<()>, so returning an error instead threads the full message through the existing handle.join().expect(...)?:

if let Err(e) = state.optimize(&plan) {
    return plan_err!(
        "thread {tid} iter {iter}: valid acyclic RLAC query failed \
         under same-context concurrency: {e}"
    );
}

While in here, two optional one-liners:

• .stack_size(8 * 1024 * 1024) is not required for this fixture — I removed it and the test still passes — so it reads as defensive. A short comment saying so would save the next reader the experiment I just ran. (It is not a bad instinct: test_composite_key_calculation in this same crate does overflow the default stack in a debug build.)
• Worth stating in the module doc that this is a probabilistic guard rather than a proof. It reproduces very strongly here, but on a single-core or heavily loaded runner it could pass despite a reintroduced regression, and a green run should not be read as "no race".

Switched the assertion to return a contextual plan_err!, so failures retain the
thread, iteration, and underlying planning error through join()?. The negative
control still fails 3/3 with the original analyzer implementation.

I kept the 8 MiB stack to match CI and the existing debug plan-analysis test
convention, documented the rationale and probabilistic nature of the stress
test, and left the sibling boolean-assertion cleanup outside this PR.

Verified: cargo check --all-targets,
RUST_MIN_STACK=8388608 cargo test --lib --tests --bins (148 passed),
cargo clippy --all-targets --all-features -- -D warnings, and
cargo fmt --all -- --check.