diff --git a/harness/analysis-mixed-acceptance-contract-20260925.md b/harness/analysis-mixed-acceptance-contract-20260925.md
new file mode 100644
index 00000000..e704cc4b
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-contract-20260925.md
@@ -0,0 +1,151 @@
+# Private actual-output rename acceptance
+
+Baseline `29417130c71f70c4eaefe8ed4c879efba78eb72c`. Select the complete pending
+owner borrow, actual-output equality bound and moved model/warning outcome after
+independent design, domain and ownership critiques. This connects the verified
+emitter and named parser producers; it is no longer another fixture-only
+continuation. The surrounding mixed implementation remains private experimental
+source. Public source8, installation/history and release integration are separate.
+
+## Authority and result
+
+Add a consuming verification operation on opaque PendingRename. Its only normal
+constructor remains validated consumed emission. No production constructor may
+accept an arbitrary bundle/model/Slots/profile tuple. Add CarriedInput::from_pending
+accepting a shared reference to that complete pending owner; derive bundle,
+exact Limits/ProjectLimits and retained O from the same owner. Both backing and
+guard retain a complete pending reference, not just numeric counters. Keep enum
+variants private and expose only narrow immutable pending views to carried code.
+
+Prefer `&'s PendingRename<'s>` inside the existing single-lifetime backing, using
+the immutable desired reference's covariance to shorten a longer desired borrow
+to the verification borrow. Actual Rust compilation must establish that relation.
+Do not thread a second lifetime through every parser owner, duplicate full policy
+inside guards, introduce a heap wrapper or permit mutation while the guard lives.
+The existing fixture constructors and old parser entry points keep their behavior.
+The new continuation is the sole emitter-connected entry into the combined text
+and retained-entry producer route, including actual zero metadata if applicable.
+
+On success return a non-self-referential owning AcceptedRename with the actual
+SourceBundle, actual resolved Project, mapped warnings, exact inherited policies
+and final retained Slots. Preserve scalar verification Usage and numeric work
+separately from original-snapshot work; no cumulative reinterpretation. The
+accepted type has private fields and read-only accessors, with no unchecked or
+mutable constructor, borrowed syntax or borrowed desired model. Source, desired
+and pending may be dropped before the accepted result is inspected.
+
+This result does not itself save files, edit history, install a model or enable
+repeated carried-source emission. Later adoption must jointly preserve its
+graph/source/diagnostic relationship; no separate mutable extraction is added.
+No-op remains the existing explicit unchanged-owner branch.
+
+## Actual verification and equality
+
+Parse the actual complete pending bundle under its exact policy using both named
+producer modes. Propagate its located parse diagnostics. Consume the resulting
+syntax through the existing resolver and complete model admission, preserving O
+through all parser/resolver stages. Never default policy, substitute intended
+tokens/model, drop untouched files, re-emit bytes for comparison or reset carry.
+
+After actual model admission reserve `E_actual = resolved.expressions.len()`
+entry slots against that resolved owner's full live ledger, which includes O,
+syntax and mapped warnings. Compare the entire actual Project with desired using
+its established PartialEq, including aliases, parameter names, all maps and
+historical payloads. Do not use rename::same_project, which exempts names. Release
+the equality frontier after comparison. A mismatch returns a small static
+invalid_source diagnostic at entry/default span0..0, not a formatted model.
+
+The independently reviewed bound follows every reachable actual Expr root:
+calculation body, property base, case overrides and check predicate. Each actual
+node has a source expression-site entry. Iterative Expr equality's live pairs
+correspond to distinct nodes of its actual left operand; list/call shape checks
+precede child queueing, and no nested equality frontier remains live. Whole-model
+comparisons visit roots sequentially. E_actual0 cannot invoke an allocating Expr
+comparison from a nonexistent actual root. Existing signed-zero PartialEq remains
+semantic equality, not bitwise equality. Revisit the proof when payload types or
+lowering/equality implementations change. Original pending E is provenance only;
+the new implementation must use the current resolved arena for its reservation.
+
+## Mapped warnings and ownership transfer
+
+Retain the mapped warnings by moving them, together with the actual resolved
+Project, after successful equality. The model remains in its existing excluded
+model-allocation domain and has already passed admission. Mapped warnings remain
+in the selected auxiliary domain. Do not clone a model, warning, path or vector.
+
+Compute warning inventory W with a checked borrowed loop over the actual records:
+one entry per warning, zero occurrences, and UTF-8 lengths of path, code, optional
+field and message. Require current mapper invariants: every related vector empty
+and no Error severity. Unexpected shapes fail before producing accepted authority;
+do not silently ignore newly introduced fields/related locations. The diagnostic
+field accounting should be exhaustive enough that schema changes demand review.
+
+W already participates in the full resolver ledger. Do not charge it twice during
+equality or transfer. Compute final O+W with checked arithmetic, verify it is a
+componentwise subset of the still-live ledger, and check its exact inherited
+ceilings while Budget exists. This is a destination-inventory check, not an early
+release: keep full coexistence accounting until all temporary owners actually
+drop. Move Project/warnings to locals, drop all verification syntax/guard,
+expression/occurrence/catalog owners, then move the pending bundle/policy into
+AcceptedRename. Rust must enforce that no pending borrow survives that move.
+Final retained counts exclude released syntax and equality scratch but include
+all surviving mapped warnings. Failure returns only diagnostics and destroys
+the consumed pending output and partial verification state.
+
+## Explicit remaining scratch decision
+
+Choose the existing logical retained domain plus the named decode/equality
+temporaries; do not expand it into universal parser/all-heap accounting. Existing
+traversal, delimiter, ordinary-open, Pratt and duplicate-name scratch retain their
+independent file/edge/token/grammar controls and are excluded from carried W.
+Significant-token storage retains its independent token ceiling; M counts the
+separate token-end representation once. No new output-verification collection
+may be hidden under an old exclusion.
+
+File count/source-text limits do not tightly bound copied traversal path bytes.
+Path folding/canonicalization and include target/location copies can occur before
+edge refusal; retain that known limitation explicitly. Open-declaration depth is
+bounded by declaration events, not typed-value depth. Pratt frames are not native
+stack bytes. Decoder/numeric internals, raw model/validator allocation, allocator
+capacity/overhead and native stack remain their established separate domains.
+Do not claim aggregate admission before every allocation or process-memory bounds.
+This resolves the earlier scratch-domain choice without waiving selected retained
+producer timing, actual output admission, equality or returned ownership.
+
+## Finite acceptance
+
+Use unchanged inherited profiles from original parse/index/plan through emission
+and verification. Never tighten an admitted owner to manufacture a late failure.
+Minimal project p→next emits81 bytes, O=(1,0,105), T11. Entries17 and bytes152
+admit the full pipeline; bytes151 reaches output UUID decode at37..38, line2
+column27, after scanner peak141 and emission peak114. Entry16 fails emission
+first and is not a later verifier cap. Assert the entire independent expected
+Project/bundle, empty warnings, final O, exact policy and separate snapshot Usage.
+
+Retain a real warning-bearing rename with an independently authored full
+diagnostic and exact final O+W. Distinguish final retention counts from greater
+earlier peaks; do not invent a final-only cap-minus-one boundary. Reuse emitter
+OA/SA/cross-file/Unicode/CRLF/swap byte oracles and whole expected models where
+valid, checking returned warning paths/spans against the actual returned bytes.
+The [empty-name warning oracle](analysis-mixed-acceptance-design-20260925/WARNING-ORACLE.md)
+uses unchanged entries18 and bytes161/160: old emission peaks159 bytes, actual
+output warning mapping161, and accepted O+W=(2 entries,0 occurrences,157 text).
+Its negative warning-map diagnostic retains the full project-header11..69 span,
+unlike the parser's one-byte token-start transport. These are expectations to
+verify, not results inferred from source arithmetic.
+
+Equal-byte test-only corruption can cover wrong-but-admissible alias/name,
+malformed source and model-invalid output while preserving O. A length-changing
+corruption must first be rejected by an explicitly selected inventory check or
+use independently verified actual-O fixture provenance, never stale counts.
+Include greater actual expression count than old E, wide/deep comparison,
+target-only mismatch and signed-zero cases. Label internal inventory/shape faults
+as such; do not relabel them as authentic emitted histories. Check true owning
+lifetime by returning success out of a scope that drops original input/desired.
+
+Preserve all previous tests, failure bodies and format disposition; run focused
+new cases, full core library, strict all-target Clippy and format comparison.
+Exercise meaningful scoped128KiB verify/drop cases with prerequisites prepared
+outside the worker, preserve all old stack controls and inspect changed
+prologues. Do not enlarge stacks, loosen policies or rerun failures until lucky.
+Older separately unrerun full-pipeline setup limitations remain distinct.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-ORACLE.md b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-ORACLE.md
new file mode 100644
index 00000000..352880c3
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-ORACLE.md
@@ -0,0 +1,136 @@
+# Independent actual-output acceptance oracle — proposal only
+
+Source inspected: `a629ae01d49bb3cb482a047eb41832ad4246a5c6`. Derived from literal
+bytes and existing source, not parser/emitter execution. Only string lengths and
+literal substring offsets were evaluated. Future verification API/domain/equality
+contract is not yet selected; all runtime acceptance remains pending.
+
+## Minimal real rename, one unchanged inherited policy
+
+Entry/key `main.arcadia` has 12 ASCII bytes. Original exact source (final LF):
+
+```text
+arcadia 8;
+project p "Project" id "00000000-0000-0000-0000-000000000001" {
+
+}
+```
+
+Desired differs only in project alias `p` -> `next`. Expected complete emitted
+bundle is exactly one file under the same entry/key, containing (final LF):
+
+```text
+arcadia 8;
+project next "Project" id "00000000-0000-0000-0000-000000000001" {
+
+}
+```
+
+Original source is 78 bytes; output is 81. The sole edit is original [19,20),
+replacement `next` (four bytes); output alias is [19,23), display text [25,32),
+UUID quoted token [37,75). Output retained O=(1 entry, 0 occurrences, 105 text),
+where 105=81 source+12 map key+12 entry bytes. No output key/path is omitted.
+
+Complete expected Project: schema_version=8; id=00000000-0000-0000-0000-000000000001;
+alias="next"; name="Project"; description=""; definitions, elements, relations,
+diagrams, artifact_links and traces are all empty maps. Expected warnings empty.
+This asserts every model field, not just the changed alias. E_original=E_actual=0.
+
+Select original Limits entries=17, bytes=152 (or 151 negative), all other fields
+unchanged from an admissible roomy source8 profile; keep the same ProjectLimits
+through original parse/index/plan/emission/verification. Never tighten live policy.
+
+| Stage | Logical entries | Logical text | Derivation |
+| --- | ---: | ---: | --- |
+| Original syntax retained |12|8|U1 + M11; alias1+name7 |
+| Original resolver peak |16|10|Project catalog +4 entries, two alias copies |
+| Original typed index retained |13|9|One global name; no typed headers/expressions |
+| Original ordinary index retained |14|9|One authored project header |
+| Rename plan peak/retained |16|9|R1 name target + namespace Q1 (then dropped), M1 edit |
+| Emission overlap |17|114|Plan16/9 + output O1/105 |
+| Output strong syntax retained |13|116|C1 + U1 + M11; C105 + T11 |
+| Output resolver peak |17|124|Syntax13 + project catalog4; two four-byte alias copies |
+| Output resolved retained/equality |13|116|Catalog dropped; E_actual0 equality scratch |
+| Owning accepted bundle after verification owners drop |1|105|Only actual output O remains |
+
+Original indexing/transient peaks do not exceed the original resolver/plan/emission
+entry ceiling17 for this empty model; prior emitted-overlap source tests explicitly
+use entries17 and bytes114 through the real predecessor path. The new proposed
+152/151 byte profiles are looser than that already authored predecessor boundary.
+No new verification allocation occurs while the old authored owner remains live.
+
+## Exact new byte boundary and timing
+
+Scanner validation of the output UUID reserves raw payload36 before decoding.
+No grammar text exists during that file scan: C105+W36=141 (display payload7 is
+smaller). Grammar first retains alias4 and display name7, hence T11. Its UUID
+consumer reserves P36 while T11 remains live: 105+11+36=152, before the existing
+serde decode. Valid decode D36 transfers then UUID parsing drops/refunds it;
+final T11 and W0. Project has no projected ordinary values or textual keys.
+
+Therefore 152 is the full-pipeline positive byte cap and 151 isolates the new
+actual-output grammar producer refusal, after predecessors/emission and scanner
+have fit. Expected source path main.arcadia, code invalid_source, message
+`Source8 index/output byte limit exceeded.`, ordinary transported span [37,38),
+line2 column27, no related locations. Raw quoted extent is [37,75), but the
+ordinary error transport intentionally retains its one-byte start representation.
+Do not expect this refusal at the former unverified-emission114 boundary.
+
+Entry cap17 permits the whole pipeline, but cap16 refuses **emission first**:
+plan16 plus O1 cannot fit. Thus it cannot demonstrate a later verification/resolver
+entry refusal. Equality reserves zero here; no equality-specific minus-one case
+exists. A different justified fixture is needed for any proposed late entry gate.
+
+## Equal-byte corruption controls (not genuine emitted results)
+
+Start each control from a fresh legitimately emitted pending owner under roomy
+unchanged inherited limits. Mutate only in the private fixture harness. Equal UTF-8
+length preserves O numerically; production must not expose mutation/constructors.
+
+- Output alias [19,23): `next` -> `nope`. Valid alias and otherwise empty model;
+  parse/admission should pass, complete Project equality must reject.
+- Output name [25,32): `Project` -> `Changed`. Valid decoded display name, same
+  seven bytes; parse/admission should pass, non-name equality must reject.
+- Version byte [8,9): `8` -> `?`. Equal bytes, malformed source; scanner/parser
+  must reject before model equality. Do not claim a successful wrong-model case.
+
+Each failure must drop pending verification state, return no accepted owner, and
+leave original source and desired unchanged. Do not recursively format models.
+The new verifier's semantic-mismatch message is deliberately unspecified here.
+
+## Actual expression count larger than original, unchanged O
+
+Use the same project wrapper with this exact single body line:
+
+```text
+calculation c "C" id "00000000-0000-0000-0000-000000000002" { result Number; body 10000; }
+```
+
+Original source168 bytes; a genuine project p->next rename emits171 bytes, O=(1,0,195).
+Desired includes the unchanged Number calculation c, same ID/name, no parameters,
+and literal10000 expression. Original arena E=1. On a fresh pending corruption
+fixture replace output expression [160,165) `10000` with `1 + 2` (five bytes).
+The bytes still describe a Number calculation, now binary Add with two numeric
+children: actual raw-expression arena E_actual=3. Bundle lengths/keys/entry/O
+remain unchanged; complete equality must reject its different body. Use roomy
+entries/bytes4096 from the original parse, not a policy replacement after emission.
+
+The equality reservation must derive 3 from the freshly resolved actual output,
+not trust pending's old scalar1. This fixture proves provenance/count selection;
+its unequal root variants may short-circuit comparison and do not prove a frontier
+actually exceeding1. Lowering already reserves five entries per actual node,
+while equality requests only E_actual. No isolated equality-cap-minus-one refusal
+is claimed; the earlier lowering peak may dominate. A meaningful additional
+wide/deep positive and target-shape mismatch must be justified independently.
+
+## Source basis and limits
+
+At the pinned source, `rename/emission.rs:6` defines the sealed pending fields;
+its output_slots counts all source/key/entry bytes, and emit_changed_unverified
+reserves old plan+O before copies and drops old source before constructing pending.
+`rename/emission/tests.rs` already pins literal NEXT and predecessor17/114.
+`mixed/project.rs:245`/`:315` reserve the project alias/owner/table catalog; catalog
+storage releases before returning resolved state. `mixed/project/accounting.rs`
+seeds syntax and lower scratch independently; LowerStorage::all uses5N+2A.
+`budget.rs::quoted_text` and raw_tokens StringEvent implement the P/D timing above.
+These are logical storage derivations, not allocator/RSS or runtime test claims.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-PROPOSAL.md b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-PROPOSAL.md
new file mode 100644
index 00000000..58e432c5
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-PROPOSAL.md
@@ -0,0 +1,85 @@
+# Actual emitted-output acceptance — working proposal
+
+2026-09-25, parent read-only design based on source97a8703 and the entry-producer
+contract; entry implementation has not yet passed gates. This is neither selected
+contract nor permission to activate public source8. No next implementation claim.
+
+The useful next outcome is a single owning accepted output after parsing the
+actual complete emitted bytes with inherited policy and carried output storage,
+resolving/admitting them and comparing the entire Project to desired intent.
+Do not insert another unneeded fixture-only milestone after the retained producer
+requirements pass. Remaining scratch-domain precision still needs explicit
+decision and independent critique; see DOMAIN-DECISION-CRITIQUE.md when ready.
+
+## Narrow authority/lifetime candidate
+
+Current private emission::PendingRename contains actual SourceBundle, exact
+Limits/ProjectLimits, reserved output Slots, original E and immutable desired
+Project borrow. Its only non-test constructor is consumed emission. Existing
+carried::CarriedInput currently accepts borrowed or fixture RetainedSnapshot.
+
+Candidate A: add a named CarriedInput::from_pending(&PendingRename), with access
+only through read-only sealed pending views. It must derive all bundle, exact
+policy and retained slots from that same pending owner, accepting no loose
+bundle/profile/Slots. Backing can store the existing bundle/policy plus a shared
+reference to the pending retained Slots; guard needs only that reference after
+policy transfers to Budget. The function's borrow lifetime keeps the entire
+pending owner unavailable for mutation or consumption during verification. This
+avoids introducing desired's second lifetime into every parser owner. Prove this
+with actual Rust type checks; do not assume a reference to counters alone is
+sufficient authority if construction can be separated from the owner.
+
+Candidate B: move owned snapshot storage into a shared RetainedSnapshot wrapper
+used by PendingRename, then reference it directly. This may simplify backing but
+must avoid an unrestricted new(bundle,slots,policy) constructor or unnecessarily
+coupling parser construction to emitter internals. Compare actual code size and
+representation before choosing. No generic trait/callback allocator framework.
+
+A consuming PendingRename::verify method borrows itself for the strong combined
+text/entry parse; every result remains local until success. Consume syntax through
+project::resolve under the same carried guard, so complete model admission is
+the existing one. After equality and bounded validation, drop resolved syntax,
+model/catalogs and guards explicitly, then move SourceBundle into a narrow
+owning accepted result. Failure returns located diagnostics and drops pending
+output; no usable partial bundle or accepted token escapes. An owned accepted
+bundle is not a self-referential parsed witness. Repeated retained-source editing
+and actual filesystem/history installation remain distinct work.
+
+## Whole equality and scratch
+
+Reuse complete Project PartialEq, including established signed-zero semantics;
+do not reuse rename::same_project, which intentionally exempts names. The
+comparator's left operand must be the freshly resolved actual output model.
+Use that resolver's actual raw-expression-site count E_actual as the conservative
+equality frontier bound, reserving it against its live ledger before comparison
+and releasing after equality returns. Original E remains provenance only and
+cannot bound faulty emitted output. Existing planner proof covers Expr's iterative
+frontier only when every actual left-model Expr root is represented in the source
+expression arena; re-audit this reachability for full Project equality (including
+opaque historical carriers) before selecting E_actual. Original scalar count is
+not proof of actual output topology. No additional counting traversal or cloning
+desired model should be introduced without its own bound.
+
+Reject malformed bytes, model-invalid bytes, admissible-but-wrong aliases and
+admissible-but-wrong non-name semantics. Error reporting must not recursively
+format arbitrary models. Exact input/output policies survive; new parser Usage
+is separate snapshot work. Output C remains live through syntax, resolver and
+equality and must never be reset to zero or added twice.
+
+## Required finite acceptance before implementation
+
+Reuse published emitter exact OA/SA/all-file/Unicode/CRLF maps as independent
+byte expectations. Construct at least one actual emitted owner whose inherited
+profile admits original parse/index/plan/emission and then passes verification,
+plus cap-minus-one refusal at the intended later stage; do not tighten a live
+owner after admission. Fake/mutated pending bytes are labeled corruption controls.
+Original empty/project rename may have a new combined producer peak greater
+than the emitter's former114-byte oracle: recompute the whole pipeline honestly.
+
+Test wrong-but-admissible output, malformed output, exact policies, complete
+source/target immutability and scope/lifetime of returned ownership. Wide/deep
+actual output versus target-only shape mismatch must establish equality's chosen
+frontier bound. New tests do not replace existing public/legacy/fmt dispositions,
+stack controls or the separately unrerun older full-pipeline setup limitation.
+Full parsed-output acceptance remains private until a separate public integration
+contract reconciles all16 schema8 failures and complete graphical/source behavior.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-SOURCE-CRITIQUE.md b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-SOURCE-CRITIQUE.md
new file mode 100644
index 00000000..28fbbd93
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTANCE-SOURCE-CRITIQUE.md
@@ -0,0 +1,29 @@
+# Independent actual-output acceptance critique
+
+2026-09-25. Design-only readback of ACCEPTANCE-PROPOSAL.md SHA256 `b59ca190e3cde85611158542ccf86e67c210b853b09a1fd0354daf57d4304509`, the ownership source map and domain critique, against local source `29417130c71f70c4eaefe8ed4c879efba78eb72c`. Entry runtime acceptance remains separate. No source edits, compiler, parser or network execution.
+
+The proposed actual-byte parse/resolve/full-equality boundary is the useful next outcome. No further fixture-only intermediary is intrinsically required once the selected prerequisites pass. Prefer Candidate A as refined by OWNERSHIP-SOURCE-MAP: retain a complete immutable PendingRename reference, with lifetime shortening through its covariant desired Project borrow. This is simpler and stronger to inspect than projecting authority down to a bare Slots reference, and avoids Candidate B's unnecessary rearrangement of existing owning fields. Actual type checks must establish the proposed coercion and borrow scope; this review does not claim compilation.
+
+## Ownership and accounting decisions to retain
+
+Pending's only production constructor is consumed emission (`mixed/project/ordinary_index/rename/emission.rs:6` and its concluding construction). Its bundle, policy and retained Slots are private; emission reserves complete O before copies and drops the old indexed owner before Pending escapes. A from_pending constructor must accept the complete pending reference only and derive all views from that object. Keep guard variants private, add no arbitrary production tuple constructor, and do not copy the full policy into the guard. Existing output keys, entry and all files remain C through the new parse and resolver.
+
+Put verification in a consuming Pending method. A local scope can borrow pending, use the strong text+entry route, consume syntax through existing project::resolve, reserve equality scratch on that resolved owner's live ledger, compare, then drop the resolved owner and all borrowing guards. Only afterward move the actual SourceBundle into a non-self-referential accepted owner. Returning borrowed syntax alongside it, resetting C to zero, defaulting policies or exposing a mutable Pending bundle would defeat this seam. None is needed. No-op remains the separately consuming original-owner branch.
+
+Choose the accepted result's retained contents explicitly. If only bundle/policy/accepted authority survives, drop resolver warnings with verification storage. If warnings are retained or returned alongside it, their mapped strings/path copies and destination slots survive too and need an explicit transfer; final live storage is no longer O alone. `mixed/project.rs` currently reserves every mapped warning before pushing it (around lines 588–643). Do not silently clone warnings or equate excluded raw validator Issues with those counted mapped diagnostics. A small entry/default-span mismatch diagnostic is sufficient; recursive formatting of whole models is unnecessary.
+
+## Actual-expression equality bound
+
+Use `resolved_actual.project().eq(desired)` under reserved `E_actual = resolved_actual.expressions.len()`, not the old pending scalar or rename::same_project. All current Project-to-Expr roots remain CalculationDefinition.body (`analysis/types.rs:85–94`), EngineeringProperty.base, AnalysisCase.overrides and AnalysisCheck.predicate (`model.rs:667–682`). Historical Trace/SemanticBaseline/FacetReview payloads are closed and contain ordinary strings/IDs/LifelineBinding rather than analysis Expr (`semantic/types.rs:84–174`, `model.rs:526,1632–1650`). The model/type/equality/lowering files are unchanged from the previously reviewed `18073a6` proof.
+
+`lower.rs:687–699,755–846` routes each real binding through expression lowering, emits one ExpressionSite per visited node, and schedules all child variants; mixed resolution retains this arena while merging model definitions/elements. `analysis/expression_lifecycle.rs:170–270` keeps one iterative pair frontier, checks list/call shape before child insertion and never invokes another Expr equality with its frontier live. Pair members correspond to distinct nodes of the actual left tree, so every simultaneously live frontier is bounded by its actual tree size, hence E_actual. Sequential whole-Project field/container comparisons do not require summing all separate equality Vecs. E_actual may conservatively reject a comparison that would short-circuit; do not promise unconditional success with no phase headroom.
+
+Make E_actual=0 explicit: derived Binding/parent variant checks reject target-only Expression before entering Expr::eq; no allocating equality call has a zero-node actual Expr. Keep whole-model PartialEq, including +0/-0 equivalence across geometry, ordinary and historical real carriers. Equality establishes semantic PartialEq, not bitwise target identity. Renew this reachability proof if Project payload types or expression production change.
+
+## Corruption controls and finite gates
+
+Corrupted Pending tests must preserve their claimed live-storage provenance. Equal-byte replacements can change valid semantics, syntax or expression topology while retaining the authenticated O. Length-changing test mutations must either be rejected by an explicitly selected inventory invariant or construct an independently verified actual-O fixture under the inherited policy; keeping stale O after growing the bundle is not evidence of correct carried accounting. Especially test faulty actual output with more expression nodes than original E to demonstrate why E_actual is used.
+
+Use one unchanged inherited profile for original parse/index/plan/emission and verification. Recompute the combined original and new-snapshot peaks; a syntax-only cap need not admit the independent counting walk, resolver catalogs or final equality. Require a real full-pipeline positive and a cap-minus-one that genuinely reaches the intended late stage, plus wrong-but-admissible names and non-name data, malformed/model-invalid output, E=0 target-only damage, actual wide/deep equality and signed zero. Drop original inputs and desired after success and inspect the independently owning returned bytes. Failed verification must yield only diagnostics and drop Pending, without exposing a usable partial bundle.
+
+The domain critique's explicit independent bounds for named remaining scratch are compatible with this outcome; they must be selected and documented, not described as aggregate carried reservations. Existing bounds/exclusions do not exempt new output ownership, equality frontier or retained mapped diagnostics. Native verifier/drop frames require concrete measurements and existing stack controls; earlier separately unrerun setup failures are not converted to success by this design. Public source8, repeated retained editing and filesystem/history adoption remain separate contracts.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/ACCEPTED-CONTENTS-CRITIQUE.md b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTED-CONTENTS-CRITIQUE.md
new file mode 100644
index 00000000..d1cc6e60
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/ACCEPTED-CONTENTS-CRITIQUE.md
@@ -0,0 +1,55 @@
+# Accepted owner contents: independent critique
+
+Read-only inspection of the current resolver/warning mapper and owned diagnostic schemas, with unchanged relevant behavior from97a8703 through2941713. No source modification, build or runtime claim. This recommends a contract choice; parent owns selection.
+
+## Recommendation
+
+Prefer an opaque owning result containing the verified SourceBundle, the **actual freshly resolved Project**, mapped warnings, exact inherited policy and its final retained Slots. This avoids throwing away already admitted graph data and actionable diagnostics immediately before a later coherent source/graph adoption step. It remains a narrow non-self-referential value: Project and SourceDiagnostic own their contents and do not borrow syntax. No history/install operation, public source8 activation or repeated-edit constructor follows automatically.
+
+Bundle/policy only is a valid smaller proof artifact, but requires a later parse/admit step to recover the graph and warnings for adoption. It is preferable only if the deliberate next consumer needs exclusively bytes and no diagnostics/model. That does not appear to match the currently described editing goal. Moving existing values after verification is smaller than introducing another cache, clone or deferred parse protocol.
+
+The accepted model must be the resolver's actual output model, not a clone/move of desired intent merely because equality passed. Whole equality is the gate, not a replacement constructor. Existing model/serde/raw-validator heap exclusions permit retaining that already admitted Project without adding its internal maps/strings to logical auxiliary W; call this an explicit inherited domain, not a claim that the Project occupies no memory.
+
+## Exact retained-warning inventory
+
+`mixed/project.rs:594–649` reserves each mapped diagnostic before its path copy/destination push. The reservation is one entry, zero occurrences, and byte lengths of path + code + optional field + message. Severity/object UUID/span/line/column are scalar; no copied text is hidden there. `source_project.rs:80–84` defines `SourceDiagnostic { path, diagnostic, related }`; mapper always creates empty related. The return at project.rs:651 rejects any Error-severity issue before returning a resolved success.
+
+For the current successful producer, compute without allocations:
+
+```
+W.entries = warnings.len()
+W.occurrences = 0
+W.text = checked sum over warnings of
+         path.len + diagnostic.code.len + optional field.len + message.len
+```
+
+Use the same Slots checked arithmetic as the mapper, not saturating sums or a numeric total copied from a previous phase. Require every related vector empty and every severity non-Error under this sealed extraction route. An unexpected shape is an invariant refusal before returning the accepted owner, never silently ignored. If later mapper changes introduce related locations, update the named inventory (entries and path bytes) and tests together; this choice does not authorize flattening/dropping them.
+
+A checked borrowed loop over current warnings allocates no extra frontier or String. Do not construct a secondary warnings Vec, clone diagnostics, format the Project, or rerun validation to count them. Current storage ledger already contains these warning reservations while syntax and equality are live; **do not reserve W a second time there**. Reconstruction for final transfer is distinct from additive growth.
+
+## Safe transition and accounting
+
+Recommended logical sequence:
+
+1. Resolve the actual complete output with carried O under exact inherited policy; keep resolver and warnings live.
+2. Reserve the selected actual-model equality scratch against the full live ledger, compare the entire actual Project with desired, and release E. Retaining warnings means they must already participate in that equality-time aggregate, as they currently do in resolver storage.
+3. Compute W from the current warning records and checked final `O + W`. Validate that final total under the resolver's original Budget while it still exists. It should be a subset of the successfully held full storage; a componentwise subset check is a useful internal invariant, not a substitute for correct ownership inventory. If checking fails, return diagnostics with the existing failure escape and drop output, never a usable partial owner.
+4. Destructure/move actual Project and warnings into local owners, explicitly drop all remaining syntax/index/expression/occurrence/catalog/guard state, then move pending SourceBundle/policy into the accepted owner. Rust must establish that the guard borrowing pending is gone before its bundle moves. No copied warning path/model is necessary and no self-reference remains.
+
+Final retained entries are O.entries + warning count; text is O.text + W.text; occurrences are O.occurrences (normally zero for the emitted bundle) plus zero. Do not carry released syntax U/M/T, equality E or resolver catalogs as live accepted storage. Conversely, do not return O alone when warnings remain owned. Model and original desired borrow do not become new logical slots merely by this ownership transition.
+
+An independently computed final subset check can happen before physically dropping other objects because it is checking the eventual destination inventory, not claiming those drops already happened. The full resolver ledger must continue to cover coexistence until actual drops. An implementation that resets that live ledger to O+W early and subsequently allocates against its artificial headroom would be incorrect.
+
+All accepted-result fields should remain private with read-only accessors. No public unchecked bundle+Project+warnings+Slots constructor, mutable bundle/model access, or from-desired shortcut. Any later consuming adoption method needs its own invariant about jointly installing graph/source/warnings. Read-only accepted ownership itself does not authorize saving/history mutation.
+
+## Finite evaluators and caveats
+
+Use a real emitted output that resolves with at least one stable mapped warning. Independently derive warning entry/text bytes from its literal expected path/code/field/message; assert warning content/location unchanged, actual Project equality and exact final O+W. A warning-free fixture alone cannot detect the dropped-W bug. Include multiple warnings or an optional field only if needed to distinguish summation from one-record handling; do not expand into a full validator redesign.
+
+Keep the equality-time warning reservation and final retention tests separate from output verification caps: final O+W is usually below the already admitted resolver/equality peak, so a purported final-only cap-minus-one failure may be impossible through a real earlier-admitted owner. Use a checked-inventory fault control for impossible overflow/related-shape defects and label it accordingly; retain a real profile unchanged through actual pipeline positives/refusals. Do not lower the policy after admission to fabricate provenance.
+
+Warnings should stay actionable after syntax drops: source path, span, Unicode line/column and optional field must still refer to the verified returned bytes. Moving them preserves the mapper's positions; rewriting output after extraction would invalidate that relation. An independently matching desired Project alone cannot establish diagnostic-to-byte identity.
+
+Optionally retain already available scalar new-snapshot Usage/static admission metadata if a concrete caller needs it, but it is not necessary to retain expression arenas or whole syntax just to avoid losing those scalars. Original work and verification work must remain separately identified. No new arbitrary constructor is justified by exposing counters.
+
+I see no correctness blocker in moving actual Project plus warnings with explicit O+W transfer. The material obligations are exact warning inventory, no duplicate charge, full-ledger coexistence through equality/drop, and sealed immutable construction. This recommendation leaves actual equality-frontier proof and output-admission behavior to their separate accepted contract/review.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/DOMAIN-DECISION-CRITIQUE.md b/harness/analysis-mixed-acceptance-design-20260925/DOMAIN-DECISION-CRITIQUE.md
new file mode 100644
index 00000000..c78284ab
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/DOMAIN-DECISION-CRITIQUE.md
@@ -0,0 +1,48 @@
+# Remaining parser scratch: bounded independent critique
+
+Read-only source basis97a8703adc75467a7f8e75f5c6cb00ca542b707c. Entry-producer work is pending and is not assumed accepted or executed here. This is a recommendation for the parent to decide, not an accepted domain change or runtime finding.
+
+## Conclusion and obligation
+
+Yes: an output-acceptance contract can explicitly preserve existing independent file/token/grammar/numeric bounds for named remaining parser scratch instead of adding all that scratch to the carried aggregate. This is consistent with the bounded logical domain, provided the contract accurately names its timing and exclusions. It must not claim one global physical memory ceiling, aggregate before-every-allocation, or that an independent bound is a reservation against the surviving output owner.
+
+The user need is reliable graphical/text/API editing and persistence. A physical heap meter is not a user-owned requirement identified in the domain audit. The accepted rename-plan contract's mandatory successor *does* require complete actual emitted output, exact inherited policy, surviving-output accounting, actual parse/resolve/admission, whole desired-Project equality with E scratch, documented old-owner transition, and no usable failed result. These are not waived by choosing a smaller scratch domain. That contract does not name every parser coordination stack as a new carried-ledger allocation.
+
+The earlier `CARRIED-STORAGE-DOMAIN-AUDIT.md` calls itself a design audit, not an accepted contract. Its recommended expansion seams and question about traversal/delimiter scratch must not silently become user requirements. In particular, its suggested significant-token push charge is not the currently accepted metric: the entry contract explicitly retains token storage under the token bound, with one token-end M subtotal reserved before ends construction. The newer text contract explicitly names its retained String producers and temporary decode/result strings. Neither permits hiding a newly introduced in-scope owned output/path/equality structure as old scratch.
+
+## What existing source actually bounds
+
+All source references below are repository-relative at97a8703.
+
+| Scratch | Existing guard or structural bound | Remaining limitation |
+| --- | --- | --- |
+| Folded path table and traversal paths | `source_project/traversal.rs:22–87` checks file count and source-text sum before its folded table; validates every supplied path. Active/visited unique paths are related to file count; pending includes to include-edge count. | File-count bounds are not total path-byte bounds. Folded Unicode path copies and canonicalization allocate outside aggregate T. `include` at149–178 resolves/copies target and location before its edge-limit refusal; it is false to describe every such temporary as guarded before growth. |
+| Traversal queue/children/active stack | Same file/edge/depth policy; `next` checks depth before visited insertion; `finish_file` transfers pending children into stack (`89–186`). | Repeated include targets still consume edges and path copies. Entry count and path text can coexist with output C without debiting its aggregate ceiling. A deep/wide graph is not bounded solely by visited-file count. |
+| Delimiter stack | `language.rs:1032–1040`: at most one push per opening delimiter in the already scanned significant-token sequence. Ends array is the selected M subtotal. | Delimiter stack is another collection, not prepaid by the same N ends reservation. Token guard is a separate finite bound; no aggregate C+M charge for delimiter slots exists. |
+| Ordinary open declarations | `language.rs:1539–1723`: stack carries indices into the flat declaration vector. Existing declaration events/model count checks precede each declaration and its open push. | Maximum live depth is structurally at most declarations. Do not claim this vector is controlled by typed-value depth64 or by the typed Pratt frame budget; those are different controls. |
+| Pratt coordination | `analysis_source/syntax.rs:18–45,60–63,154–264`: tasks/values/sequence coordination are iterative; expression/operator/argument events, raw tokens and relevant grammar-frame checks constrain growth. | Not every Vec push has its own reserve, and grammar frame count is not native stack bytes. Completed subtree values remain owned while siblings parse. Existing small-stack successes are finite evidence, not a universal stack guarantee. |
+| Typed duplicate-name/ID sets | `declarations.rs:284–307,604–624` and `syntax.rs:238–249`: entries track already charged declarations/arguments/overrides. Named string clones derive from parsed reference/name text. | These clones are explicitly excluded scratch, not retained T or scanner/grammar decode W. Work count bounds their number, not independently their total copied bytes; original text/source bounds provide an additional constraint. No existing aggregate reservation covers their overlap. |
+
+These are finite structural relationships, not exact peak formulas. With unlimited/wide configured policies, they may be practically large. UTF-8 case folding, path normalization, repeated path copies, large sequence coordination and native enum sizes are reasons not to present the logical ceiling as a process-memory bound.
+
+## Choices
+
+1. **Retain named independent bounds, explicitly excluded from carried W.** Smallest next step. Complete selected retained T/U/M hooks and reconciliation; retain exact existing traversal/token/grammar checks and refusal semantics; finish owning actual-output admission/equality. Document the table above in the acceptance contract. This is my recommendation for the currently stated editing objective.
+
+2. **Add selected scratch W, starting with a demonstrated problem.** Useful if a specific unbounded or disproportionate copy threatens the intended deployment, or if the parent selects a stronger aggregate resource promise. For example, traversal path storage would require canonicalization/folded-path temporary and queue ownership decisions, with path-byte rather than just file-slot accounting. A delimiter-only W is simpler but proves nothing about the other excluded structures. Each addition needs before-growth placement, release/transfer rules and a literal peak oracle; it is not a harmless extension to current caps.
+
+3. **Universal parser/all-heap containment.** Much larger and unsupported as the automatic next prerequisite. Allocator capacity, model/serde/validator and numeric internals are already excluded by accepted contracts. Instrumenting only parser stacks would still not establish this promise.
+
+Do not choose option1 while retaining prose from option2 that says all parser auxiliary storage is charged against C. Conversely, do not block actual-output correctness on proving an unrequested universal bound.
+
+## Concrete evidence needs without scope expansion
+
+Before relying on the existing bounds, source review must establish each structural relationship and no new output-verification helper bypasses its existing checks. Reuse existing limit controls where they already cover duplicate include edges, depth, token exhaustion, declaration nesting and wide/deep expressions. A missing relevant control is a reason for one finite diagnostic test, not a generic scratch allocator framework.
+
+The clearest risk deserving a specific design note is traversal path text: source-byte sum excludes map keys, and include canonicalization occurs before edge refusal. The accepted owned-output C already counts all emitted path keys and entry text, but that does not account folded/path queue copies. Either explicitly retain this limitation, or select a separate path-specific strengthening. Do not claim file/source limits alone provide a tight path-byte peak. No measured failure in this review requires instrumentation immediately.
+
+New accepted-output lifetime/equality scratch is different: it is explicitly mandated and cannot be excluded as parser coordination. Preserve old B during emission, carry actual O after the documented old-owner drop, include new verification syntax/storage against O, reserve E against the correct verification live total, and drop temporary verification before returning a non-self-referential owning accepted result. An excluded raw desired/model borrow does not justify losing in-scope path/output copies. Retained mapped diagnostics continue to require their existing reservations even though transient refusal diagnostics have an escape.
+
+Native stack risk remains empirical. Preserve existing128KiB/deep/wide controls and inspect changed prologues if new state/hooks alter frames. A stack failure is not repaired by putting vector slots in W; neither a phase check nor a token bound proves Rust stack headroom. Do not relax tests to support a stronger claim.
+
+Suggested precise acceptance wording: “The verifier checks the declared retained syntax and auxiliary domain, plus the named temporary decode and equality domains, against the exact inherited aggregate policy including surviving output. Existing traversal, delimiter, ordinary-open, Pratt and duplicate-name scratch retain their independent file/edge/token/grammar bounds and are excluded from that aggregate metric. This is not a physical-memory or before-every-allocation guarantee.” Actual source/evidence must support the selected hooks before that wording is claimed implemented.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/OWNERSHIP-SOURCE-MAP.md b/harness/analysis-mixed-acceptance-design-20260925/OWNERSHIP-SOURCE-MAP.md
new file mode 100644
index 00000000..13828ce2
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/OWNERSHIP-SOURCE-MAP.md
@@ -0,0 +1,97 @@
+# Pending output ownership source map — proposal only
+
+Source inspected: `a629ae01d49bb3cb482a047eb41832ad4246a5c6`; no compilation,
+source modification or acceptance claim. This refines only the lifetime seam in
+[ACCEPTANCE-PROPOSAL.md](ACCEPTANCE-PROPOSAL.md), not equality/scratch policy.
+Paths below are relative to `.local/as3batch` at that commit.
+
+## Existing authority
+
+`crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename/emission.rs:6`
+owns PendingRename's bundle, exact Limits/ProjectLimits, retained Slots, original
+expression count and immutable desired Project reference. Its constructor at the
+end of `emit_changed_unverified` follows output reservation and explicit old-owner
+drop; no public bundle/slots constructor exists. Those private fields currently
+prevent sibling carried code from reading authority.
+
+`.../mixed/carried.rs:40` consumes CarriedInput into a bundle reference, one policy
+value and a slim guard. `:63` derives C from that guard; `:116` selects both producer
+modes. `.../mixed.rs:39` stores the guard alongside the borrowed bundle and Budget;
+`:308` is the shared parser. Consumed resolution at `.../mixed/project.rs:453`
+retains that syntax. None of these owners currently needs desired's lifetime.
+
+## Recommend Candidate A with a complete pending reference
+
+The smallest variant avoids projecting authority down to a bare `&Slots` at all:
+
+```rust
+// Private variants in the existing enums; no new allocating wrapper.
+SnapshotBacking::Pending(&'s PendingRename<'s>)
+GuardBacking::Pending(&'s PendingRename<'s>)
+
+impl<'s> CarriedInput<'s> {
+    pub(super) fn from_pending<'t: 's>(p: &'s PendingRename<'t>) -> Self {
+        Self { backing: SnapshotBacking::Pending(p) }
+    }
+}
+```
+
+This is a proposed Rust shape, not a compiler-tested patch. PendingRename is
+covariant in its sole lifetime: the only use is `desired: &'t Project`, and all
+other fields own data without that lifetime. Consequently the longer desired
+borrow can be shortened to the pending borrow `'s` when storing `p`. The original
+pending value retains its original type/lifetime; no data moves or self-reference
+is created. Parser, resolved and indexed owner types keep their single existing
+`'s`. Immutable `&PendingRename` itself prevents mutation, consumption or dropping
+its bundle while syntax/guard remain usable. No trait object or PhantomData proof
+is needed, and future invariant lifetime-bearing fields would require revisiting
+this coercion rather than silently bypassing it.
+
+Add narrowly visible immutable Pending methods `bundle() -> &SourceBundle`,
+`policy() -> (Limits, ProjectLimits)` and `retained() -> Slots`, restricted to
+`pub(in crate::language::analysis_source::mixed)`. CarriedInput accepts only the
+complete pending reference, never those components as independent arguments.
+`into_parts` derives bundle/policy from its stored pending and transfers the same
+reference into GuardBacking::Pending; `slots()` calls that pending's retained
+method. Policy is copied once into the existing preparse transfer value and then
+Budget/syntax limits; the guard contains only one pointer, not another policy.
+Pending necessarily retains its original immutable policy as owner provenance.
+No recomputation of C, tuple authentication or runtime identity comparison helps.
+
+## Candidate B and visibility
+
+Embedding an owned RetainedSnapshot in Pending would remove the cross-reference
+between carried and emission modules and also avoid desired lifetime covariance.
+It adds no necessary heap allocation, but replaces existing pending fields,
+changes emission construction and existing direct inspection tests, and requires
+a controlled production snapshot constructor or wider sibling field authority.
+That larger migration has no present ownership benefit over the complete pointer.
+Prefer B only if later genuinely shared owning snapshot behavior justifies it.
+
+The module paths are already visible: `ordinary_index.rs:433` exposes rename to
+analysis_source, and `rename.rs:2` exposes emission likewise. Pending type itself
+has that visibility. Keep carried private to mixed; descendants can name its
+module. The needed changes are just its from_pending entry point and a named
+strong parse entry with visibility up to mixed, plus the three immutable pending
+views. Keep SnapshotBacking/GuardBacking variants and fields private to carried;
+do not export SnapshotPolicy or add arbitrary production RetainedSnapshot inputs.
+
+## Consuming verification and finite type checks
+
+Implement verify in emission, where it can consume self and eventually move its
+private bundle. A local block calls the strong parser with from_pending(&self),
+consumes syntax into resolve, performs separately specified bounded equality,
+then drops resolved owner/guard before leaving that block. Only afterward move
+self.bundle into an owning accepted result. No parsed witness or desired borrow
+escapes, so accepted output has no lifetime parameter or self-reference. Failure
+returns diagnostics and drops self; successful no-op remains the separate old
+owner branch. This note does not select accepted-result extraction/installation.
+
+Compiler acceptance must demonstrate: long-lived desired + local pending can
+produce a short scoped syntax; resolved owner cannot outlive pending; moving or
+mutating pending while the guard is subsequently used is rejected; dropping all
+verification borrows permits moving the bundle into the accepted owner. Positive
+runtime tests should drop original input and desired after acceptance and still
+inspect returned output. Preserve exact inherited policies and C once throughout;
+no new carrying-mode bypass or policy mutation. Any compile-fail examples should
+be narrow external snippets/appropriate harness, not runtime unsafe tricks.
diff --git a/harness/analysis-mixed-acceptance-design-20260925/WARNING-ORACLE.md b/harness/analysis-mixed-acceptance-design-20260925/WARNING-ORACLE.md
new file mode 100644
index 00000000..749bcbb5
--- /dev/null
+++ b/harness/analysis-mixed-acceptance-design-20260925/WARNING-ORACLE.md
@@ -0,0 +1,60 @@
+# Independent unnamed-project warning oracle
+
+Authored from existing mapper/catalog/index/emission logic at2941713 (relevant behavior unchanged from97a8703), not parser or runtime output. This is a prospective acceptance evaluator, not a passing execution claim. Literal-only Python checked lengths, hashes and offsets; no compiler/parser/binary ran.
+
+## Exact original and output
+
+Single file/entry `main.arcadia` (12 UTF-8 bytes each). Original71-byte source, including final LF:
+
+```text
+arcadia 8;
+project p "" id "00000000-0000-0000-0000-000000000001" {
+
+}
+```
+
+Original SHA256 `68b9215285d622c77b46df105839f65c40fb76f2ba7c55a6a9cbbc1fc4576146`. Rename only project aliasp→next; physical original alias span19..20. Output74-byte literal:
+
+```text
+arcadia 8;
+project next "" id "00000000-0000-0000-0000-000000000001" {
+
+}
+```
+
+Output SHA256 `dbde19f06d6bde26c16b4672dcc43036dec693fb04ebc23de76e4faa369dd81f`. O=(entries1, occurrences0, text98), since74+12+12=98. Exact inherited entries18 and bytes161 are the proposed unchanged positive policy; bytes160 is the proposed late-refusal sibling, with all other limits roomy and unchanged throughout each pipeline. Original parsing must be the supported legacy uncarried route because changed emission rejects carried syntax.
+
+## Complete expected Project and warning
+
+Actual accepted Project must have schema_version8, UUID00000000-0000-0000-0000-000000000001, alias`next`, name`""`, description`""`, and all six maps empty: definitions, elements, relations, diagrams, artifact_links, traces. Original Project differs only in alias`p`. No expressions or lowered occurrences exist, so E_actual=0 for equality.
+
+Exactly one mapped diagnostic is expected:
+
+- path`main.arcadia`; related empty;
+- severityWarning; code`unnamed`; object_idSome(ID1); fieldSome(`name`);
+- message`Give the project a descriptive name.` (36 bytes);
+- output span11..69, line2, column1.
+
+`validation.rs:325–333` emits that warning for empty trimmed project name. `project.rs:666+` falls back to the project header for the name field; empty name does not manufacture a field span. Header start11 is unchanged, opening brace69 ends the output header. Original warning instead spans11..66. The returned warning must be the output warning, not one moved from original admission.
+
+Current mapper `project.rs:594–649` makes W=(entries1, occurrences0, text59): path12 + code7 + field4 + message36. Scalar span/UUID/severity/line/column add no string bytes. Final accepted O+W=(2,0,157). Model payload remains the established excluded domain; this is not its physical memory size.
+
+## Verification peak, with catalog lifetime
+
+Output U1/M11/T4: one project syntax event, F1+ten significant tokens, aliasnext4 and empty name/description. Work bytes74, raw tokens19, references0, numeric units0. Combined retained syntax is entries13/text102=O98+T4. Scanner temporary36 fits134; grammar project UUID temporary36 overlaps alias4, requiring138. No ordinary positions, value maps or typed syntax exist.
+
+Catalog creation reserves alias/owner2 entries with alias4 text, then table2 entries with another alias4 (`project.rs:240–325`). Its peak is entries17/text110. `project.rs:521–524` drops aliases before lowering; `557–560` drops tables before warning mapping. Thus neither extra alias copy remains at the warning reservation. The owner table remains one entry, no text, through mapping, and drops afterward (`655`).
+
+Immediately before warning mapping: entries14=syntax13+owner1, text102. The mapped warning reserve adds1/59, reaching entries15/text161. At bytes160 the exact refusal is `Source8 index/output byte limit exceeded.`, codeinvalid_source, pathmain.arcadia, span11..69, line2column1, no related diagnostics. This typed mapper failure preserves the full header span; it is not the ordinary parser's one-byte transport. Bytes161 admits this reservation. Owner table then drops, leaving resolver entries14/text161 =O + U/M/T + W. EqualityE0 adds nothing. After syntax drops, retained accepted inventory is entries2/text157.
+
+The final O+W check is not itself the161-byte peak and must not be called the site of160 refusal. It rechecks the smaller eventual retained subset. The intended negative occurs before warning destination allocation while original output-owned C is still live.
+
+## Original predecessor clearance under the same policy
+
+Original uncarried syntax has U1/M11/T1. Its name is empty; original mapped warning has the same59-byte string inventory. Catalog peaks at syntax12+4=16 entries and text3; at warning mapping it retains syntax12+owner1+warning1=14 entries/text60. Owner release leaves13 entries/text60. Typed index adds one retained global-name entry/text1, giving14/text61. Ordinary authored index adds one header occurrence entry; its one-global reverse map is temporary, so final authored state15/text61. No expression/occurrence/field work adds another slot.
+
+Plan stores one changed-name entry and one physical edit entry; replacements borrow desired and add no owned text. Its final state is17 entries/text61. Collision-check one-element namespace occurs before the edit exists, so it does not exceed17. E0 adds no equality scratch. Old emitted-output overlap is17+O1=18 entries and61+98=159 text. Both bytes160 and161 therefore clear old parser/resolver/index/plan/emission; source/output byte lengths71/74 also fit. Emission drops old owner/warning before verification, so the old59 warning bytes do not coexist with the new warning map.
+
+This derivation agrees with the existing named empty emission envelope after removing seven old name bytes and adding one59-byte/one-entry original warning. It is nevertheless an independently traceable source calculation, not a runtime result. Do not introduce a default policy, a newly tightened pending owner, or a borrowed numeric baseline to make the negative pass earlier stages.
+
+Expected real end-to-end distinction: identical entries18 and other policies, bytes161 succeeds with exact output/Project/warning/O+W; bytes160 reaches actual-output warning mapping and refuses there. If runtime rejects earlier, investigate actual source/lifetime/count differences rather than changing the oracle from observed output. Additional copy/reservation introduced by the future acceptance implementation must be disclosed and independently justified before claiming this cap.