Split private Pratt steps to reduce numeric parser stack overlap

crates/oa-core/src/language/analysis_source/budget.rs

@@ -64,6 +64,10 @@ impl Budget {
             failed: None,
         })
     }
+    /// Immutable exact policy snapshot for private deliberate-snapshot continuation.
+    pub(super) fn limits(&self) -> Limits {
+        self.limits
+    }
     pub fn active(&self) -> Result<(), Error> {
         self.failed.clone().map_or(Ok(()), Err)
     }

crates/oa-core/src/language/analysis_source/mixed.rs

@@ -27,6 +27,8 @@ use crate::language::{
 use crate::source_project::{ProjectLimits, SourceBundle, SourceDiagnostic, traversal::Traversal};
 use std::collections::BTreeMap;
 
+mod carried;
+
 struct ModelCounts {
     limits: ProjectLimits,
     graph: usize,
@@ -44,6 +46,8 @@ pub(super) struct ParsedMixedSyntax<'s> {
     // Includes the conservative dropped value-end subtotal. The semantic
     // phase adds syntax entries to this once, not tokens/positions again.
     metadata: usize,
+    // Kept through consumed resolution/indexing; fixes the live backing owner.
+    carried: Option<carried::CarriedGuard<'s>>,
 }
 
 struct FileSyntax<'s> {
@@ -246,6 +250,15 @@ fn parse_with_profile(
     limits: ProjectLimits,
     profile: Limits,
 ) -> Result<ParsedMixedSyntax<'_>, Vec<SourceDiagnostic>> {
+    parse_impl(bundle, limits, profile, None)
+}
+
+fn parse_impl<'s>(
+    bundle: &'s SourceBundle,
+    limits: ProjectLimits,
+    profile: Limits,
+    carried: Option<carried::CarriedGuard<'s>>,
+) -> Result<ParsedMixedSyntax<'s>, Vec<SourceDiagnostic>> {
     let entry_source = bundle.files.get(&bundle.entry).map_or("", String::as_str);
     let at_entry = |error| located(&bundle.entry, entry_source, ordinary_error(error));
     let maximum = Limits::source8(ParseLimits {
@@ -266,6 +279,9 @@ fn parse_with_profile(
         )));
     }
     let mut budget = Budget::new(profile).map_err(at_entry)?;
+    if let Some(input) = &carried {
+        input.check(&budget, 0, 0).map_err(at_entry)?;
+    }
     let bytes = bundle
         .files
         .values()
@@ -275,9 +291,13 @@ fn parse_with_profile(
         .index_bytes(bytes, Span::default())
         .map_err(at_entry)?;
     let mut metadata = bundle.files.len();
-    budget
-        .lowering_entries(metadata, Span::default())
-        .map_err(at_entry)?;
+    if let Some(input) = &carried {
+        input.check(&budget, 0, metadata).map_err(at_entry)?;
+    } else {
+        budget
+            .lowering_entries(metadata, Span::default())
+            .map_err(at_entry)?;
+    }
     // Tighter private byte/file-slot limits precede folded-path table and
     // traversal allocations. Public Traversal's own validation order is intact.
     let mut traversal = Traversal::new(bundle, limits)?;
@@ -325,10 +345,16 @@ fn parse_with_profile(
             .and_then(|n| n.checked_add(projection_slots))
             .and_then(|n| n.checked_add(state.lexical_owners.len()))
             .ok_or_else(|| failure(super::error(Span::default(), "Metadata size overflow.")))?;
-        state
-            .budget
-            .lowering_entries(metadata, Span::default())
-            .map_err(failure)?;
+        if let Some(input) = &carried {
+            input
+                .check(state.budget, state.budget.usage.entries, metadata)
+                .map_err(failure)?;
+        } else {
+            state
+                .budget
+                .lowering_entries(metadata, Span::default())
+                .map_err(failure)?;
+        }
         let positions = language::edit_positions_from_tokens(
             source,
             &ordinary,
@@ -367,12 +393,18 @@ fn parse_with_profile(
     }
     traversal.finish()?;
     budget.active().map_err(at_entry)?;
+    if let Some(input) = &carried {
+        input
+            .check(&budget, budget.usage.entries, metadata)
+            .map_err(at_entry)?;
+    }
     Ok(ParsedMixedSyntax {
         bundle,
         limits,
         files: parsed.into_values().collect(),
         budget,
         metadata,
+        carried,
     })
 }
 

crates/oa-core/src/language/analysis_source/mixed/carried.rs

@@ -0,0 +1,141 @@
+//! Fixture-constructible carried phase authority, not an emitted-output result.
+//! Checks existing logical phase totals; does not meter every parser allocation.
+use super::*;
+use project::accounting::{Ledger, Slots};
+
+struct SnapshotPolicy {
+    limits: Limits,
+    project_limits: ProjectLimits,
+}
+
+/// The allocation-owning bundle guard. No production constructor exists yet.
+struct RetainedSnapshot {
+    bundle: SourceBundle,
+    policy: SnapshotPolicy,
+    retained: Slots,
+}
+enum SnapshotBacking<'s> {
+    Borrowed {
+        bundle: &'s SourceBundle,
+        policy: SnapshotPolicy,
+    },
+    Retained(&'s RetainedSnapshot),
+}
+
+/// Neither Clone nor Copy: fixes the bundle, policy and retained allocation owner.
+pub(super) struct CarriedInput<'s> {
+    backing: SnapshotBacking<'s>,
+}
+enum GuardBacking<'s> {
+    Borrowed,
+    Retained(&'s RetainedSnapshot),
+}
+
+/// Policy has transferred into Budget/ParsedMixedSyntax. Only backing ownership
+/// remains here, avoiding a duplicate inline policy in every later witness.
+pub(super) struct CarriedGuard<'s> {
+    backing: GuardBacking<'s>,
+}
+impl<'s> CarriedInput<'s> {
+    fn into_parts(self) -> (&'s SourceBundle, SnapshotPolicy, CarriedGuard<'s>) {
+        match self.backing {
+            SnapshotBacking::Borrowed { bundle, policy } => (
+                bundle,
+                policy,
+                CarriedGuard {
+                    backing: GuardBacking::Borrowed,
+                },
+            ),
+            SnapshotBacking::Retained(owner) => (
+                &owner.bundle,
+                SnapshotPolicy {
+                    limits: owner.policy.limits,
+                    project_limits: owner.policy.project_limits,
+                },
+                CarriedGuard {
+                    backing: GuardBacking::Retained(owner),
+                },
+            ),
+        }
+    }
+}
+impl CarriedGuard<'_> {
+    pub(super) fn slots(&self) -> Slots {
+        match &self.backing {
+            GuardBacking::Borrowed => Slots::default(),
+            GuardBacking::Retained(owner) => owner.retained,
+        }
+    }
+    pub(super) fn check(
+        &self,
+        budget: &Budget,
+        syntax: usize,
+        metadata: usize,
+    ) -> Result<(), super::super::Error> {
+        let at = Span::default();
+        let total = self
+            .slots()
+            .add(Slots::entries(syntax), at)?
+            .add(Slots::entries(metadata), at)?;
+        // A local check, not another reservation retained in the syntax owner.
+        Ledger::default().reserve(budget, total, at)
+    }
+}
+
+/// Input already binds the actual bundle; callers cannot supply a replacement.
+fn parse_carried(input: CarriedInput<'_>) -> Result<ParsedMixedSyntax<'_>, Vec<SourceDiagnostic>> {
+    let (bundle, policy, guard) = input.into_parts();
+    parse_impl(bundle, policy.project_limits, policy.limits, Some(guard))
+}
+
+#[cfg(test)]
+impl SnapshotPolicy {
+    fn captured(syntax: &ParsedMixedSyntax<'_>) -> Self {
+        Self {
+            limits: syntax.budget.limits(),
+            project_limits: syntax.limits,
+        }
+    }
+}
+#[cfg(test)]
+impl RetainedSnapshot {
+    fn fixture(bundle: SourceBundle, policy: SnapshotPolicy) -> Result<Self, super::super::Error> {
+        let at = Span::default();
+        let mut text = bundle.entry.len();
+        for (path, source) in &bundle.files {
+            text = Slots::text(text)
+                .add(Slots::text(path.len()), at)?
+                .add(Slots::text(source.len()), at)?
+                .text;
+        }
+        let retained = Slots {
+            entries: bundle.files.len(),
+            occurrences: 0,
+            text,
+        };
+        Ok(Self {
+            bundle,
+            policy,
+            retained,
+        })
+    }
+    fn input(&self) -> CarriedInput<'_> {
+        CarriedInput {
+            backing: SnapshotBacking::Retained(self),
+        }
+    }
+}
+#[cfg(test)]
+impl<'s> CarriedInput<'s> {
+    fn borrowed(bundle: &'s SourceBundle, syntax: &ParsedMixedSyntax<'_>) -> Self {
+        Self {
+            backing: SnapshotBacking::Borrowed {
+                bundle,
+                policy: SnapshotPolicy::captured(syntax),
+            },
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/mixed/carried/tests.rs

@@ -0,0 +1,729 @@
+use super::*;
+use crate::language::analysis_source::budget::Usage;
+fn doc(body: &str) -> String {
+    format!(
+        "arcadia 8;\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {{\n{body}\n}}\n"
+    )
+}
+fn empty() -> SourceBundle {
+    SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([("main.arcadia".into(), doc(""))]),
+    }
+}
+fn chain() -> SourceBundle {
+    SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([
+            ("main.arcadia".into(), doc("include \"part.arcadia\";")),
+            (
+                "part.arcadia".into(),
+                "include \"last.arcadia\";\r\n".into(),
+            ),
+            ("last.arcadia".into(), "//é\r\n".into()),
+        ]),
+    }
+}
+fn profile(entries: usize, bytes: usize) -> Limits {
+    Limits {
+        entries,
+        bytes,
+        ..Limits::source8(ParseLimits::UNLIMITED)
+    }
+}
+// Fixture-only policies may deliberately be too tight to admit the target.
+// These are validated profiles, not a production old-owner transition.
+fn fixture_policy(limits: Limits, project_limits: ProjectLimits) -> SnapshotPolicy {
+    SnapshotPolicy {
+        limits: Budget::new(limits).unwrap().limits(),
+        project_limits,
+    }
+}
+fn owner(bundle: SourceBundle, limits: Limits) -> RetainedSnapshot {
+    RetainedSnapshot::fixture(bundle, fixture_policy(limits, ProjectLimits::default())).unwrap()
+}
+fn parse_failure(result: Result<ParsedMixedSyntax<'_>, Vec<SourceDiagnostic>>) -> SourceDiagnostic {
+    let errors = match result {
+        Ok(_) => panic!("unexpected syntax success"),
+        Err(e) => e,
+    };
+    assert_eq!(errors.len(), 1);
+    errors.into_iter().next().unwrap()
+}
+fn resolve_failure(syntax: ParsedMixedSyntax<'_>) -> SourceDiagnostic {
+    let failure = match project::resolve(syntax) {
+        Ok(_) => panic!("unexpected resolution success"),
+        Err(e) => e,
+    };
+    assert_eq!(failure.diagnostics.len(), 1);
+    failure.diagnostics.into_iter().next().unwrap()
+}
+fn diagnostic(d: &SourceDiagnostic, path: &str, start: usize, end: usize, message: &str) {
+    assert_eq!(d.path, path);
+    assert_eq!(d.diagnostic.code, "invalid_source");
+    assert_eq!(d.diagnostic.span, Span { start, end });
+    assert_eq!(d.diagnostic.message, message);
+    assert!(d.related.is_empty());
+}
+fn expected_project() -> crate::Project {
+    crate::Project {
+        schema_version: 8,
+        id: Id::parse_str("00000000-0000-0000-0000-000000000001").unwrap(),
+        alias: "p".into(),
+        name: "Project".into(),
+        description: String::new(),
+        definitions: BTreeMap::new(),
+        elements: BTreeMap::new(),
+        relations: BTreeMap::new(),
+        diagrams: BTreeMap::new(),
+        artifact_links: BTreeMap::new(),
+        traces: BTreeMap::new(),
+    }
+}
+#[test]
+fn real_retained_bundles_keep_exact_guard_work_and_once_only_resolved_baseline() {
+    for (bundle, c, u, m, live, entries, bytes) in [
+        (
+            empty(),
+            Slots {
+                entries: 1,
+                occurrences: 0,
+                text: 102,
+            },
+            Usage {
+                bytes: 78,
+                tokens: 19,
+                entries: 1,
+                references: 0,
+                deepest_frame: 0,
+            },
+            11,
+            Slots {
+                entries: 13,
+                occurrences: 0,
+                text: 110,
+            },
+            17,
+            112,
+        ),
+        (
+            chain(),
+            Slots {
+                entries: 3,
+                occurrences: 0,
+                text: 180,
+            },
+            Usage {
+                bytes: 132,
+                tokens: 31,
+                entries: 3,
+                references: 0,
+                deepest_frame: 0,
+            },
+            19,
+            Slots {
+                entries: 25,
+                occurrences: 0,
+                text: 212,
+            },
+            29,
+            214,
+        ),
+    ] {
+        let owner = owner(bundle, profile(entries, bytes));
+        assert_eq!(owner.retained, c);
+        let original = owner.bundle.clone();
+        let parsed = parse_carried(owner.input()).unwrap();
+        assert_eq!(parsed.metadata, m);
+        assert_eq!(parsed.budget.usage, u);
+        assert_eq!(parsed.budget.numeric_units(), 0);
+        assert!(std::ptr::eq(parsed.bundle, &owner.bundle));
+        assert!(
+            matches!(&parsed.carried.as_ref().unwrap().backing,GuardBacking::Retained(retained) if std::ptr::eq(*retained,&owner))
+        );
+        let resolved = project::resolve(parsed).unwrap();
+        assert_eq!(resolved.project(), &expected_project());
+        assert!(resolved.warnings().is_empty());
+        let (syntax, stored) = resolved.phase_state();
+        assert_eq!(stored, live);
+        assert_eq!(syntax.budget.usage, u);
+        assert_eq!(syntax.carried.as_ref().unwrap().slots(), c);
+        assert_eq!(
+            syntax.files.iter().map(|f| f.path).collect::<Vec<_>>(),
+            original
+                .files
+                .keys()
+                .map(String::as_str)
+                .collect::<Vec<_>>()
+        );
+        drop(resolved);
+        assert_eq!(owner.bundle, original);
+    }
+}
+#[test]
+fn independent_combined_syntax_caps_and_canonical_failure_files() {
+    for (bundle, cap, path) in [(empty(), 13, "main.arcadia"), (chain(), 25, "part.arcadia")] {
+        let pass = owner(bundle.clone(), profile(cap, 1024));
+        drop(parse_carried(pass.input()).unwrap());
+        let fail = owner(bundle, profile(cap - 1, 1024));
+        let d = parse_failure(parse_carried(fail.input()));
+        diagnostic(&d, path, 0, 1, "Source8 lowering entry limit exceeded.");
+        assert_eq!((d.diagnostic.line, d.diagnostic.column), (1, 1));
+    }
+    let owner = owner(chain(), profile(20, 1024));
+    diagnostic(
+        &parse_failure(parse_carried(owner.input())),
+        "main.arcadia",
+        0,
+        1,
+        "Source8 lowering entry limit exceeded.",
+    );
+}
+#[test]
+fn legacy_zero_timing_is_preserved_but_explicit_zero_carry_still_combines() {
+    let bundle = empty();
+    let original =
+        parse_with_profile(&bundle, ProjectLimits::default(), profile(11, 1024)).unwrap();
+    diagnostic(
+        &parse_failure(parse_carried(CarriedInput::borrowed(&bundle, &original))),
+        "main.arcadia",
+        0,
+        1,
+        "Source8 lowering entry limit exceeded.",
+    );
+    diagnostic(
+        &resolve_failure(original),
+        "main.arcadia",
+        0,
+        0,
+        "Source8 lowering entry limit exceeded.",
+    );
+    let original =
+        parse_with_profile(&bundle, ProjectLimits::default(), profile(12, 1024)).unwrap();
+    let carried = parse_carried(CarriedInput::borrowed(&bundle, &original)).unwrap();
+    assert_eq!(carried.budget.usage, original.budget.usage);
+    assert_eq!(carried.metadata, 11);
+}
+#[test]
+fn resolver_entry_and_catalog_text_caps_include_c_once_after_parser_success() {
+    for (bundle, entries, bytes) in [(empty(), 17, 112), (chain(), 29, 214)] {
+        for limits in [profile(entries - 1, bytes), profile(entries, bytes - 1)] {
+            let held = owner(bundle.clone(), limits);
+            let parsed = parse_carried(held.input()).unwrap();
+            diagnostic(
+                &resolve_failure(parsed),
+                "main.arcadia",
+                11,
+                73,
+                if limits.entries == entries - 1 {
+                    "Source8 lowering entry limit exceeded."
+                } else {
+                    "Source8 index/output byte limit exceeded."
+                },
+            );
+            drop(
+                project::resolve(
+                    parse_with_profile(&bundle, ProjectLimits::default(), limits).unwrap(),
+                )
+                .unwrap(),
+            );
+        }
+    }
+}
+#[test]
+fn syntax_text_accounting_is_after_decoding_and_has_precise_original_location() {
+    for (bundle, bytes, path, start, end) in [
+        (empty(), 109, "main.arcadia", 11, 73),
+        (chain(), 211, "part.arcadia", 0, 23),
+    ] {
+        let held = owner(bundle, profile(100, bytes));
+        let parsed = parse_carried(held.input()).unwrap();
+        assert_eq!(
+            parsed
+                .files
+                .iter()
+                .find_map(|f| f.ordinary.header.as_ref())
+                .unwrap()
+                .project
+                .name,
+            "Project"
+        );
+        diagnostic(
+            &resolve_failure(parsed),
+            path,
+            start,
+            end,
+            "Source8 index/output byte limit exceeded.",
+        );
+    }
+}
+#[test]
+fn initial_c_and_file_slots_are_checked_before_traversal() {
+    for (bundle, cap) in [(empty(), 1), (chain(), 5)] {
+        let held = owner(bundle, profile(cap, 1024));
+        diagnostic(
+            &parse_failure(parse_carried(held.input())),
+            "main.arcadia",
+            0,
+            1,
+            "Source8 lowering entry limit exceeded.",
+        );
+    }
+    for (cap, code) in [(1, "invalid_source"), (2, "project_limit")] {
+        let held = RetainedSnapshot::fixture(
+            empty(),
+            fixture_policy(
+                profile(cap, 1024),
+                ProjectLimits {
+                    max_files: 0,
+                    ..ProjectLimits::default()
+                },
+            ),
+        )
+        .unwrap();
+        assert_eq!(
+            parse_failure(parse_carried(held.input())).diagnostic.code,
+            code
+        );
+    }
+    let held = owner(empty(), profile(100, 101));
+    diagnostic(
+        &parse_failure(parse_carried(held.input())),
+        "main.arcadia",
+        0,
+        1,
+        "Source8 index/output byte limit exceeded.",
+    );
+    let held = owner(empty(), profile(100, 102));
+    drop(parse_carried(held.input()).unwrap());
+}
+#[test]
+fn explicit_fault_injections_cover_occurrence_caps_and_unreachable_overflows() {
+    let mut held = owner(empty(), profile(100, 1024));
+    let maximum = held.policy.limits.entries + held.policy.limits.references;
+    // Not real bundle ownership: only a fault-injected dimension check.
+    held.retained.occurrences = maximum;
+    drop(parse_carried(held.input()).unwrap());
+    held.retained.occurrences = maximum + 1;
+    diagnostic(
+        &parse_failure(parse_carried(held.input())),
+        "main.arcadia",
+        0,
+        1,
+        "Source8 lowering occurrence limit exceeded.",
+    );
+    held.retained = Slots {
+        entries: usize::MAX,
+        occurrences: 0,
+        text: 0,
+    };
+    let budget = Budget::new(profile(100, 1024)).unwrap();
+    // Valid hard limits reject C first: direct injection reaches arithmetic.
+    assert_eq!(
+        held.input()
+            .into_parts()
+            .2
+            .check(&budget, 0, 1)
+            .unwrap_err()
+            .message,
+        "Mixed auxiliary storage size overflow."
+    );
+    held.retained = Slots::default();
+    assert_eq!(
+        held.input()
+            .into_parts()
+            .2
+            .check(&budget, usize::MAX, 1)
+            .unwrap_err()
+            .message,
+        "Mixed auxiliary storage size overflow."
+    );
+    assert_eq!(
+        Slots::text(usize::MAX)
+            .add(Slots::text(1), Span::default())
+            .unwrap_err()
+            .message,
+        "Mixed auxiliary storage size overflow."
+    );
+    let mut ledger = Ledger {
+        live: Slots::entries(usize::MAX),
+    };
+    assert_eq!(
+        ledger
+            .reserve(&budget, Slots::entries(1), Span::default())
+            .unwrap_err()
+            .message,
+        "Mixed auxiliary storage size overflow."
+    );
+}
+
+fn same_policy(syntax: &ParsedMixedSyntax<'_>, policy: &SnapshotPolicy) {
+    let a = syntax.budget.limits();
+    let b = policy.limits;
+    assert_eq!(
+        [a.bytes, a.tokens, a.entries, a.references, a.frames],
+        [b.bytes, b.tokens, b.entries, b.references, b.frames]
+    );
+    assert_eq!(a.numeric_units, b.numeric_units);
+    let a = syntax.limits;
+    let b = policy.project_limits;
+    assert_eq!(
+        [
+            a.max_files,
+            a.max_include_depth,
+            a.max_include_edges,
+            a.model.max_source_bytes,
+            a.model.max_graph_objects,
+            a.model.max_records,
+            a.model.max_step_references
+        ],
+        [
+            b.max_files,
+            b.max_include_depth,
+            b.max_include_edges,
+            b.model.max_source_bytes,
+            b.model.max_graph_objects,
+            b.model.max_records,
+            b.model.max_step_references
+        ]
+    );
+}
+#[test]
+fn exact_policy_capture_preserves_every_field_and_starts_fresh_snapshot_work() {
+    let base = empty();
+    let next = chain();
+    let limits = Limits {
+        bytes: 4096,
+        tokens: 2048,
+        entries: 1024,
+        references: 128,
+        frames: 64,
+        numeric_units: 4096,
+    };
+    let caller = ProjectLimits {
+        max_files: 7,
+        max_include_depth: 5,
+        max_include_edges: 9,
+        model: ParseLimits {
+            max_source_bytes: 8192,
+            max_graph_objects: 10,
+            max_records: 30,
+            max_step_references: 256,
+        },
+    };
+    let seed = parse_with_profile(&base, caller, limits).unwrap();
+    assert_eq!(seed.budget.usage.bytes, 78);
+    let input = CarriedInput::borrowed(&next, &seed);
+    let captured = SnapshotPolicy::captured(&seed);
+    drop(seed);
+    let parsed = parse_carried(input).unwrap();
+    same_policy(&parsed, &captured);
+    assert_eq!(
+        parsed.budget.usage,
+        Usage {
+            bytes: 132,
+            tokens: 31,
+            entries: 3,
+            references: 0,
+            deepest_frame: 0
+        }
+    );
+    assert_eq!(parsed.budget.numeric_units(), 0);
+    let resolved = project::resolve(parsed).unwrap();
+    same_policy(resolved.phase_state().0, &captured);
+}
+#[test]
+fn inherited_byte_token_and_traversal_limits_reach_the_real_parser() {
+    let seed_bundle = empty();
+    let bundle = chain();
+    for (bytes, tokens, success) in [(132, 31, true), (131, 31, false), (132, 30, false)] {
+        let limits = Limits {
+            tokens,
+            ..profile(100, bytes)
+        };
+        let seed = parse_with_profile(&seed_bundle, ProjectLimits::default(), limits).unwrap();
+        let result = parse_carried(CarriedInput::borrowed(&bundle, &seed));
+        if success {
+            drop(project::resolve(result.unwrap()).unwrap());
+        } else {
+            let d = parse_failure(result);
+            if bytes == 131 {
+                diagnostic(
+                    &d,
+                    "main.arcadia",
+                    0,
+                    1,
+                    "Source8 index/output byte limit exceeded.",
+                );
+            } else {
+                diagnostic(&d, "last.arcadia", 5, 6, "Source8 tokens limit exceeded.");
+                assert_eq!((d.diagnostic.line, d.diagnostic.column), (1, 5));
+            }
+        }
+    }
+    for (files, depth, edges, success) in [
+        (3, 2, 2, true),
+        (2, 2, 2, false),
+        (3, 1, 2, false),
+        (3, 2, 1, false),
+    ] {
+        let caller = ProjectLimits {
+            max_files: files,
+            max_include_depth: depth,
+            max_include_edges: edges,
+            ..ProjectLimits::default()
+        };
+        let seed = parse_with_profile(&seed_bundle, caller, profile(100, 1024)).unwrap();
+        let result = parse_carried(CarriedInput::borrowed(&bundle, &seed));
+        if success {
+            drop(project::resolve(result.unwrap()).unwrap());
+        } else {
+            let d = parse_failure(result);
+            assert_eq!(d.diagnostic.code, "project_limit");
+            if files == 2 {
+                assert_eq!(d.path, "main.arcadia");
+            } else {
+                assert_eq!(d.path, "part.arcadia");
+                assert_eq!(
+                    d.diagnostic.span,
+                    Span {
+                        start: 0,
+                        end: if edges == 1 { 1 } else { 23 }
+                    }
+                );
+            }
+        }
+    }
+}
+fn typed(expression: &str) -> SourceBundle {
+    SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([(
+            "main.arcadia".into(),
+            doc(&format!(
+                "calculation c \"C\" id \"00000000-0000-0000-0000-000000000002\" {{ input x id \"00000000-0000-0000-0000-000000000003\" : Number; result Number; body {expression}; }}"
+            )),
+        )]),
+    }
+}
+#[test]
+fn captured_numeric_reference_frame_and_model_policies_are_behavioral_not_just_copied() {
+    let base = empty();
+    for (target, limits, expected) in [
+        (
+            typed("1"),
+            Limits {
+                numeric_units: 72,
+                ..profile(1000, 4096)
+            },
+            "NumericUnits",
+        ),
+        (
+            typed("$x"),
+            Limits {
+                references: 0,
+                ..profile(1000, 4096)
+            },
+            "Source8 references limit exceeded.",
+        ),
+        (
+            typed("abs(1)"),
+            Limits {
+                frames: 0,
+                ..profile(1000, 4096)
+            },
+            "Source8 syntax frames limit exceeded.",
+        ),
+    ] {
+        let seed = parse_with_profile(&base, ProjectLimits::default(), limits).unwrap();
+        let d = parse_failure(parse_carried(CarriedInput::borrowed(&target, &seed)));
+        assert!(d.diagnostic.message.contains(expected), "{:?}", d);
+    }
+    for expression in ["1", "$x", "abs(1)"] {
+        let target = typed(expression);
+        let seed =
+            parse_with_profile(&base, ProjectLimits::default(), profile(1000, 4096)).unwrap();
+        drop(
+            project::resolve(parse_carried(CarriedInput::borrowed(&target, &seed)).unwrap())
+                .unwrap(),
+        );
+    }
+    // Nonzero old numeric work must not leak into the second snapshot.
+    let one = typed("1");
+    let limits = Limits {
+        numeric_units: 73,
+        ..profile(1000, 4096)
+    };
+    let seed = parse_with_profile(&one, ProjectLimits::default(), limits).unwrap();
+    assert_eq!(seed.budget.numeric_units(), 73);
+    let parsed = parse_carried(CarriedInput::borrowed(&one, &seed)).unwrap();
+    assert_eq!(parsed.budget.numeric_units(), 73);
+    assert_eq!(parsed.budget.usage, seed.budget.usage);
+    for (graph, records, steps) in [(0, 10, 10), (10, 1, 10), (10, 10, 0)] {
+        let caller = ProjectLimits {
+            model: ParseLimits {
+                max_graph_objects: graph,
+                max_records: records,
+                max_step_references: steps,
+                ..ParseLimits::UNLIMITED
+            },
+            ..ProjectLimits::default()
+        };
+        let seed = parse_with_profile(
+            &base,
+            caller,
+            Limits::source8(ParseLimits {
+                max_step_references: steps,
+                ..ParseLimits::UNLIMITED
+            }),
+        )
+        .unwrap();
+        let target = if steps == 0 { typed("$x") } else { typed("1") };
+        let errors = parse_carried(CarriedInput::borrowed(&target, &seed));
+        if steps == 0 {
+            assert!(
+                parse_failure(errors)
+                    .diagnostic
+                    .message
+                    .contains("references")
+            );
+        } else {
+            assert!(parse_failure(errors).diagnostic.message.contains("limit"));
+        }
+    }
+}
+#[test]
+fn zero_carried_mixed_oa_sa_unicode_results_and_index_ownership_match_legacy() {
+    for (activity, property, layer) in [
+        ("oa_activity", "oa_property", "Oa"),
+        ("sa_function", "sa_property", "Sa"),
+    ] {
+        let body = format!(
+            "node n id \"00000000-0000-0000-0000-000000000004\" {{ diagram @d; element @v; }}\n{property} v \"Value\" id \"00000000-0000-0000-0000-000000000003\" {{ subject @w; type Number; base 1; }}\n{activity} w \"Work\" id \"00000000-0000-0000-0000-000000000002\" {{}}\ndiagram d \"Diagram\" id \"00000000-0000-0000-0000-000000000005\" {{ layer {layer}; }}"
+        );
+        let bundle = SourceBundle {
+            entry: "main.arcadia".into(),
+            files: BTreeMap::from([(
+                "main.arcadia".into(),
+                format!("// 雨\r\n{}", doc(&body).replace('\n', "\r\n")),
+            )]),
+        };
+        let legacy = parse(&bundle, ProjectLimits::default()).unwrap();
+        let carried = parse_carried(CarriedInput::borrowed(&bundle, &legacy)).unwrap();
+        assert_eq!(legacy.budget.usage, carried.budget.usage);
+        assert_eq!(
+            legacy.budget.numeric_units(),
+            carried.budget.numeric_units()
+        );
+        assert_eq!(legacy.metadata, carried.metadata);
+        let legacy = project::resolve(legacy).unwrap();
+        let carried = project::resolve(carried).unwrap();
+        assert_eq!(legacy.project(), carried.project());
+        assert_eq!(legacy.warnings(), carried.warnings());
+        assert_eq!(legacy.phase_state().1, carried.phase_state().1);
+        assert!(carried.phase_state().0.carried.is_some());
+        let legacy = legacy.index().unwrap().index_ordinary().unwrap();
+        let carried = carried.index().unwrap().index_ordinary().unwrap();
+        assert_eq!(legacy.names(), carried.names());
+        assert_eq!(legacy.typed_occurrences(), carried.typed_occurrences());
+        assert_eq!(
+            legacy.ordinary_occurrences(),
+            carried.ordinary_occurrences()
+        );
+        assert!(std::ptr::eq(carried.bundle(), &bundle));
+    }
+}
+
+#[test]
+fn ordinary_position_key_copy_is_counted_at_existing_postparse_text_phase() {
+    let source = doc(
+        "oa_activity a \"A\" id \"00000000-0000-0000-0000-000000000002\" { description \"é\"; }",
+    );
+    let start = source.find("description \"é\";").unwrap();
+    let end = start + "description \"é\";".len();
+    let bundle = SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([("main.arcadia".into(), source)]),
+    };
+    let retained_text = bundle.files["main.arcadia"].len() + 24;
+    // Existing text metric: project8 + alias/name2 + field-span key11 +
+    // AST field key11 + decoded string2 + projected field key11 =45.
+    // The final11-byte key is copied before resolve accounts this phase.
+    let held = owner(bundle, profile(1000, retained_text + 44));
+    let parsed = parse_carried(held.input()).unwrap();
+    assert_eq!(parsed.files[0].positions.len(), 1);
+    diagnostic(
+        &resolve_failure(parsed),
+        "main.arcadia",
+        start,
+        end,
+        "Source8 index/output byte limit exceeded.",
+    );
+}
+
+#[test]
+fn emission_refuses_changed_carried_even_zero_and_preserves_noop_guards() {
+    for retained in [false, true] {
+        let held = owner(empty(), profile(100, 4096));
+        let seed =
+            parse_with_profile(&held.bundle, ProjectLimits::default(), profile(100, 4096)).unwrap();
+        for changed in [false, true] {
+            let input = if retained {
+                held.input()
+            } else {
+                CarriedInput::borrowed(&held.bundle, &seed)
+            };
+            let parsed = parse_carried(input).unwrap();
+            let original_guard = parsed.carried.as_ref().unwrap().slots();
+            let resolved = project::resolve(parsed).unwrap();
+            let source = resolved.index().unwrap().index_ordinary().unwrap();
+            let mut desired = source.project().clone();
+            if changed {
+                desired.alias = "next".into();
+            }
+            let plan = source.plan_rename(&desired).unwrap();
+            if changed {
+                let error = match plan.emit_changed_unverified(&held.bundle) {
+                    Ok(_) => panic!("carried changed emission must refuse"),
+                    Err(e) => e,
+                };
+                diagnostic(
+                    &error.diagnostics[0],
+                    "main.arcadia",
+                    0,
+                    0,
+                    "Changed emission requires original legacy syntax.",
+                );
+            } else {
+                let source = plan.into_unchanged(&held.bundle).unwrap();
+                assert!(std::ptr::eq(source.bundle(), &held.bundle));
+                // The intact owner can be consumed through another no-op plan;
+                // no production getter exposes or replaces its guard.
+                let source = source
+                    .plan_rename(&desired)
+                    .unwrap()
+                    .into_unchanged(&held.bundle)
+                    .unwrap();
+                assert!(std::ptr::eq(source.bundle(), &held.bundle));
+                let mut changed_desired = desired.clone();
+                changed_desired.alias = "next".into();
+                assert!(
+                    source
+                        .plan_rename(&changed_desired)
+                        .unwrap()
+                        .emit_changed_unverified(&held.bundle)
+                        .is_err()
+                );
+            }
+            assert_eq!(
+                original_guard,
+                if retained {
+                    held.retained
+                } else {
+                    Slots::default()
+                }
+            );
+            assert_eq!(held.bundle.files["main.arcadia"], doc(""));
+        }
+    }
+}

crates/oa-core/src/language/analysis_source/mixed/project.rs

@@ -28,6 +28,10 @@ impl ResolvedMixedProject<'_> {
     pub fn project(&self) -> &Project {
         &self.project
     }
+    #[cfg(test)]
+    pub(super) fn phase_state(&self) -> (&ParsedMixedSyntax<'_>, Slots) {
+        (&self.syntax, self.storage.live)
+    }
     pub fn warnings(&self) -> &[SourceDiagnostic] {
         &self.warnings
     }
@@ -438,7 +442,12 @@ fn active_references(
 pub(in crate::language::analysis_source) fn resolve(
     mut syntax: ParsedMixedSyntax<'_>,
 ) -> Result<ResolvedMixedProject<'_>, Failure> {
-    let mut storage = Ledger::default();
+    let mut storage = Ledger {
+        live: syntax
+            .carried
+            .as_ref()
+            .map_or_else(Slots::default, |input| input.slots()),
+    };
     let lower_storage = accounting::syntax(&syntax, &mut storage)?;
     let catalog = catalog(&syntax, &mut storage)?;
     let entry = entry(&syntax);

crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index.rs

@@ -429,3 +429,5 @@ fn word(unit: &FileSyntax<'_>, at: Span, expected: &str) -> Result<(), TypedErro
 
 #[cfg(test)]
 mod tests;
+
+pub(in crate::language::analysis_source) mod rename;

crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename.rs

@@ -0,0 +1,492 @@
+//! Complete-target rename planning and private unverified emission; no admission.
+pub(in crate::language::analysis_source) mod emission;
+use super::*;
+use crate::source_project::SourceBundle;
+use lower::Target;
+
+pub(in crate::language::analysis_source) struct RenamePlan<'s, 't> {
+    source: AuthoredMixedProject<'s>,
+    desired: &'t Project,
+    names: BTreeMap<Target, &'t str>,
+    edits: BTreeMap<OrdinaryKey, Target>,
+}
+impl<'s> AuthoredMixedProject<'s> {
+    pub fn plan_rename<'t>(mut self, desired: &'t Project) -> Result<RenamePlan<'s, 't>, Failure> {
+        let mut failure_file = None;
+        let result = (|| {
+            let resolved = &mut self.indexed.resolved;
+            let e = resolved.expressions.len();
+            resolved.storage.reserve(
+                &resolved.syntax.budget,
+                Slots::entries(e),
+                Span::default(),
+            )?;
+            let equal = same_project(&resolved.project, desired);
+            resolved.storage.release(Slots::entries(e));
+            if !equal {
+                return Err(error(
+                    Span::default(),
+                    "Rename target changes non-name project semantics.",
+                ));
+            }
+            let mut names = BTreeMap::new();
+            let mut bytes = 0;
+            visit_names(desired, &mut |target, name| {
+                let old = self.indexed.data.names.get(&target).ok_or_else(|| {
+                    error(
+                        Span::default(),
+                        "Rename target is absent from the original catalog.",
+                    )
+                })?;
+                if old != name {
+                    bytes = add(bytes, name.len(), Span::default())?;
+                    self.indexed
+                        .resolved
+                        .syntax
+                        .budget
+                        .index_bytes(bytes, Span::default())?;
+                    if !crate::model::valid_alias(name) {
+                        return Err(error(Span::default(), "Invalid rename alias."));
+                    }
+                    self.indexed.resolved.storage.reserve(
+                        &self.indexed.resolved.syntax.budget,
+                        Slots::entries(1),
+                        Span::default(),
+                    )?;
+                    if names.insert(target, name).is_some() {
+                        return Err(error(Span::default(), "Duplicate rename target."));
+                    }
+                }
+                Ok(())
+            })?;
+            if !names.is_empty() {
+                let mut namespace = BTreeSet::new();
+                for (target, old) in &self.indexed.data.names {
+                    let scope = match target {
+                        Target::Global(_) => None,
+                        Target::Parameter { calculation, .. } => Some(*calculation),
+                    };
+                    let name = names.get(target).copied().unwrap_or(old);
+                    self.indexed.resolved.storage.reserve(
+                        &self.indexed.resolved.syntax.budget,
+                        Slots::entries(1),
+                        Span::default(),
+                    )?;
+                    if !namespace.insert((scope, name)) {
+                        return Err(error(
+                            Span::default(),
+                            "Rename aliases collide in their final namespace.",
+                        ));
+                    }
+                }
+                let q = namespace.len();
+                drop(namespace);
+                self.indexed.resolved.storage.release(Slots::entries(q));
+            }
+            let mut edits = BTreeMap::new();
+            for (key, location) in &self.indexed.data.occurrences {
+                if names.contains_key(&key.target) {
+                    failure_file = Some(location.file);
+                    insert_edit(
+                        &mut self.indexed.resolved.storage,
+                        &self.indexed.resolved.syntax.budget,
+                        &mut edits,
+                        (location.file, location.span.start, location.span.end),
+                        key.target,
+                    )?;
+                }
+            }
+            for (&key, occurrence) in &self.ordinary {
+                let target = Target::Global(occurrence.target);
+                if names.contains_key(&target) {
+                    failure_file = Some(key.0);
+                    insert_edit(
+                        &mut self.indexed.resolved.storage,
+                        &self.indexed.resolved.syntax.budget,
+                        &mut edits,
+                        key,
+                        target,
+                    )?;
+                }
+            }
+            Ok((names, edits))
+        })();
+        let (names, edits) = result.map_err(|error| {
+            Failure::index(
+                &self.indexed.resolved.syntax,
+                lower::Failure {
+                    file: failure_file,
+                    error,
+                },
+            )
+        })?;
+        let plan = RenamePlan {
+            source: self,
+            desired,
+            names,
+            edits,
+        };
+        plan.validate()?;
+        Ok(plan)
+    }
+}
+fn insert_edit(
+    storage: &mut Ledger,
+    budget: &Budget,
+    edits: &mut BTreeMap<OrdinaryKey, Target>,
+    key: OrdinaryKey,
+    target: Target,
+) -> Result<(), TypedError> {
+    let at = Span {
+        start: key.1,
+        end: key.2,
+    };
+    if edits.contains_key(&key) {
+        return Err(error(at, "Duplicate rename physical token."));
+    }
+    storage.reserve(budget, Slots::entries(1), at)?;
+    edits.insert(key, target);
+    Ok(())
+}
+impl<'s, 't> RenamePlan<'s, 't> {
+    pub fn source(&self) -> &AuthoredMixedProject<'s> {
+        &self.source
+    }
+    pub fn desired(&self) -> &'t Project {
+        self.desired
+    }
+    pub fn changed_names(&self) -> &BTreeMap<Target, &'t str> {
+        &self.names
+    }
+    pub fn edits(&self) -> &BTreeMap<OrdinaryKey, Target> {
+        &self.edits
+    }
+    pub fn validate_current(&self, current: &SourceBundle) -> Result<(), Failure> {
+        let old = self.source.bundle();
+        if old.entry != current.entry || old.files != current.files {
+            return Err(self.failure(
+                None,
+                error(
+                    Span::default(),
+                    "Current complete bundle differs from the rename snapshot.",
+                ),
+            ));
+        }
+        Ok(())
+    }
+    fn failure(&self, file: Option<usize>, error: TypedError) -> Failure {
+        Failure::index(
+            &self.source.indexed.resolved.syntax,
+            lower::Failure { file, error },
+        )
+    }
+    fn validate(&self) -> Result<(), Failure> {
+        let mut previous: Option<OrdinaryKey> = None;
+        for (&key, target) in &self.edits {
+            let at = Span {
+                start: key.1,
+                end: key.2,
+            };
+            let checked = (|| {
+                let unit = self
+                    .source
+                    .indexed
+                    .resolved
+                    .syntax
+                    .files
+                    .get(key.0)
+                    .ok_or_else(|| error(at, "Rename token has no original file."))?;
+                let original = self
+                    .source
+                    .names()
+                    .get(target)
+                    .ok_or_else(|| error(at, "Rename token has no original target."))?;
+                if !self.names.contains_key(target) {
+                    return Err(error(at, "Rename token targets an unchanged name."));
+                }
+                if at.start >= at.end {
+                    return Err(error(at, "Rename token must be nonempty."));
+                }
+                word(unit, at, original)?;
+                if previous.is_some_and(|p| p.0 == key.0 && p.2 > key.1) {
+                    return Err(error(at, "Rename token ranges overlap."));
+                }
+                Ok(())
+            })();
+            checked.map_err(|e| self.failure(Some(key.0), e))?;
+            previous = Some(key);
+        }
+        let mut required = 0;
+        for (key, location) in self.source.typed_occurrences() {
+            self.require(
+                (location.file, location.span.start, location.span.end),
+                key.target,
+                &mut required,
+            )?;
+        }
+        for (&key, occurrence) in self.source.ordinary_occurrences() {
+            self.require(key, Target::Global(occurrence.target), &mut required)?;
+        }
+        if required != self.edits.len() {
+            return Err(self.failure(
+                None,
+                error(Span::default(), "Rename edit set contains extra tokens."),
+            ));
+        }
+        self.output_bytes()?;
+        Ok(())
+    }
+    fn require(
+        &self,
+        key: OrdinaryKey,
+        target: Target,
+        required: &mut usize,
+    ) -> Result<(), Failure> {
+        if self.names.contains_key(&target) {
+            let at = Span {
+                start: key.1,
+                end: key.2,
+            };
+            if self.edits.get(&key) != Some(&target) {
+                return Err(self.failure(
+                    Some(key.0),
+                    error(at, "Rename edit set is missing a required target token."),
+                ));
+            }
+            *required = add(*required, 1, at).map_err(|e| self.failure(Some(key.0), e))?;
+        }
+        Ok(())
+    }
+    pub fn output_bytes(&self) -> Result<usize, Failure> {
+        let result = (|| {
+            let mut total = 0;
+            let mut edits = self.edits.iter().peekable();
+            for (file, _, original) in self.source.files() {
+                let mut removed = 0;
+                let mut replaced = 0;
+                while let Some((&key, target)) = edits.peek().copied() {
+                    if key.0 != file {
+                        break;
+                    }
+                    let at = Span {
+                        start: key.1,
+                        end: key.2,
+                    };
+                    removed = add(
+                        removed,
+                        key.2
+                            .checked_sub(key.1)
+                            .ok_or_else(|| error(at, "Invalid rename token size."))?,
+                        at,
+                    )?;
+                    replaced = add(
+                        replaced,
+                        self.names
+                            .get(target)
+                            .ok_or_else(|| error(at, "Rename token has no replacement."))?
+                            .len(),
+                        at,
+                    )?;
+                    edits.next();
+                }
+                let size = original.len().checked_sub(removed).ok_or_else(|| {
+                    error(Span::default(), "Rename removals exceed original file.")
+                })?;
+                total = add(
+                    total,
+                    add(size, replaced, Span::default())?,
+                    Span::default(),
+                )?;
+            }
+            if edits.next().is_some() {
+                return Err(error(
+                    Span::default(),
+                    "Rename edit file is outside original bundle.",
+                ));
+            }
+            self.source
+                .indexed
+                .resolved
+                .syntax
+                .budget
+                .index_bytes(total, Span::default())?;
+            Ok(total)
+        })();
+        result.map_err(|e| self.failure(None, e))
+    }
+}
+
+// Exhaustive exclusion patterns make every new field an explicit gate decision.
+macro_rules! fixed {
+    ($old:expr, $new:expr, $ty:path, [$($field:ident),*], [$($excluded:ident),*]) => {{
+        let $ty { $($field,)* $($excluded: _,)* } = $old;
+        true $(&& $field == &$new.$field)*
+    }};
+}
+fn map_same<T>(
+    old: &BTreeMap<Id, T>,
+    new: &BTreeMap<Id, T>,
+    same: impl Fn(&T, &T) -> bool,
+) -> bool {
+    old.len() == new.len()
+        && old
+            .iter()
+            .zip(new)
+            .all(|((a, x), (b, y))| a == b && same(x, y))
+}
+fn same_project(a: &Project, b: &Project) -> bool {
+    fixed!(
+        a,
+        b,
+        Project,
+        [schema_version, id, name, description],
+        [
+            alias,
+            definitions,
+            elements,
+            relations,
+            diagrams,
+            artifact_links,
+            traces
+        ]
+    ) && map_same(&a.definitions, &b.definitions, |a, b| {
+        fixed!(
+            a,
+            b,
+            analysis::Definition,
+            [id, name, description],
+            [alias, body]
+        ) && match (&a.body, &b.body) {
+            (
+                analysis::DefinitionBody::Calculation(a),
+                analysis::DefinitionBody::Calculation(b),
+            ) => {
+                a.parameters.len() == b.parameters.len()
+                    && a.parameters
+                        .iter()
+                        .zip(&b.parameters)
+                        .all(|(a, b)| fixed!(a, b, analysis::Parameter, [id, value_type], [name]))
+                    && fixed!(
+                        a,
+                        b,
+                        analysis::CalculationDefinition,
+                        [result, body],
+                        [parameters]
+                    )
+            }
+            (
+                analysis::DefinitionBody::QuantityKind(a),
+                analysis::DefinitionBody::QuantityKind(b),
+            ) => a == b,
+            (analysis::DefinitionBody::Unit(a), analysis::DefinitionBody::Unit(b)) => a == b,
+            _ => false,
+        }
+    }) && map_same(&a.elements, &b.elements, |a, b| {
+        fixed!(
+            a,
+            b,
+            crate::Element,
+            [id, name, description, parent, body],
+            [alias]
+        )
+    }) && map_same(&a.relations, &b.relations, |a, b| {
+        fixed!(
+            a,
+            b,
+            crate::Relation,
+            [id, name, description, body],
+            [alias]
+        )
+    }) && map_same(&a.diagrams, &b.diagrams, |a, b| {
+        fixed!(
+            a,
+            b,
+            crate::Diagram,
+            [
+                id,
+                name,
+                description,
+                layer,
+                projection,
+                view_options,
+                routes
+            ],
+            [alias, nodes]
+        ) && map_same(&a.nodes, &b.nodes, |a, b| {
+            fixed!(
+                a,
+                b,
+                crate::NodePlacement,
+                [id, element, position, size, collapsed, port_anchors],
+                [alias]
+            )
+        })
+    }) && map_same(&a.artifact_links, &b.artifact_links, |a, b| {
+        fixed!(
+            a,
+            b,
+            crate::ArtifactLink,
+            [
+                id,
+                name,
+                description,
+                owner,
+                relation,
+                uri,
+                revision,
+                fragment
+            ],
+            [alias]
+        )
+    }) && map_same(&a.traces, &b.traces, |a, b| {
+        fixed!(
+            a,
+            b,
+            crate::Trace,
+            [id, name, description, oa, sa, kind, baseline],
+            [alias]
+        )
+    })
+}
+fn visit_names<'t>(
+    project: &'t Project,
+    f: &mut impl FnMut(Target, &'t str) -> Result<(), TypedError>,
+) -> Result<(), TypedError> {
+    f(Target::Global(project.id), &project.alias)?;
+    for d in project.definitions.values() {
+        f(Target::Global(d.id), &d.alias)?;
+        if let analysis::DefinitionBody::Calculation(c) = &d.body {
+            for p in &c.parameters {
+                f(
+                    Target::Parameter {
+                        calculation: d.id,
+                        parameter: p.id,
+                    },
+                    &p.name,
+                )?;
+            }
+        }
+    }
+    for e in project.elements.values() {
+        f(Target::Global(e.id), &e.alias)?;
+    }
+    for r in project.relations.values() {
+        f(Target::Global(r.id), &r.alias)?;
+    }
+    for d in project.diagrams.values() {
+        f(Target::Global(d.id), &d.alias)?;
+        for n in d.nodes.values() {
+            f(Target::Global(n.id), &n.alias)?;
+        }
+    }
+    for a in project.artifact_links.values() {
+        f(Target::Global(a.id), &a.alias)?;
+    }
+    for t in project.traces.values() {
+        f(Target::Global(t.id), &t.alias)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename/emission.rs

@@ -0,0 +1,152 @@
+//! Owned output only. No parser, extraction or accepted-result conversion.
+use super::*;
+use crate::language::analysis_source::budget::Limits;
+use crate::source_project::ProjectLimits;
+
+pub(in crate::language::analysis_source) struct PendingRename<'t> {
+    bundle: SourceBundle,
+    limits: Limits,
+    project_limits: ProjectLimits,
+    retained: Slots,
+    expression_nodes: usize,
+    desired: &'t Project,
+}
+
+impl<'s, 't> RenamePlan<'s, 't> {
+    pub fn into_unchanged(
+        self,
+        current: &SourceBundle,
+    ) -> Result<AuthoredMixedProject<'s>, Failure> {
+        self.validate_current(current)?;
+        self.validate()?;
+        if !self.names.is_empty() {
+            return Err(self.failure(None, error(Span::default(), "Rename plan changes names.")));
+        }
+        Ok(self.source)
+    }
+
+    pub fn emit_changed_unverified(
+        mut self,
+        current: &SourceBundle,
+    ) -> Result<PendingRename<'t>, Failure> {
+        self.validate_current(current)?;
+        self.validate()?;
+        if self.names.is_empty() {
+            return Err(self.failure(None, error(Span::default(), "Rename plan is unchanged.")));
+        }
+        if self.source.indexed.resolved.syntax.carried.is_some() {
+            return Err(self.failure(
+                None,
+                error(
+                    Span::default(),
+                    "Changed emission requires original legacy syntax.",
+                ),
+            ));
+        }
+        let total = self.output_bytes()?;
+        let retained =
+            output_slots(self.source.bundle(), total).map_err(|e| self.failure(None, e))?;
+        let resolved = &mut self.source.indexed.resolved;
+        resolved
+            .storage
+            .reserve(&resolved.syntax.budget, retained, Span::default())
+            .map_err(|e| self.failure(None, e))?;
+
+        // The complete output reservation precedes every owned byte and entry.
+        let mut files = BTreeMap::new();
+        let mut produced = 0;
+        for (file, path, original) in self.source.files() {
+            let result = (|| {
+                let edits = || {
+                    self.edits
+                        .range((file, 0, 0)..=(file, usize::MAX, usize::MAX))
+                };
+                let mut removed = 0;
+                let mut replacement = 0;
+                for (&(_, start, end), target) in edits() {
+                    let at = Span { start, end };
+                    removed = add(
+                        removed,
+                        end.checked_sub(start)
+                            .ok_or_else(|| error(at, "Invalid rename token size."))?,
+                        at,
+                    )?;
+                    replacement = add(replacement, self.names[target].len(), at)?;
+                }
+                let size = add(
+                    original.len().checked_sub(removed).ok_or_else(|| {
+                        error(Span::default(), "Rename removals exceed original file.")
+                    })?,
+                    replacement,
+                    Span::default(),
+                )?;
+                let mut output = String::with_capacity(size);
+                let mut cursor = 0;
+                for (&(_, start, end), target) in edits() {
+                    let at = Span { start, end };
+                    output.push_str(
+                        original
+                            .get(cursor..start)
+                            .ok_or_else(|| error(at, "Invalid rename output range."))?,
+                    );
+                    output.push_str(self.names[target]);
+                    cursor = end;
+                }
+                output.push_str(
+                    original
+                        .get(cursor..)
+                        .ok_or_else(|| error(Span::default(), "Invalid rename output tail."))?,
+                );
+                if output.len() != size {
+                    return Err(error(Span::default(), "Rename output length mismatch."));
+                }
+                produced = add(produced, size, Span::default())?;
+                Ok(output)
+            })();
+            let output = result.map_err(|e| self.failure(Some(file), e))?;
+            files.insert(path.to_owned(), output);
+        }
+        if files.len() != retained.entries || produced != total {
+            return Err(self.failure(None, error(Span::default(), "Incomplete rename output.")));
+        }
+        let bundle = SourceBundle {
+            entry: self.source.bundle().entry.clone(),
+            files,
+        };
+        let limits = self.source.indexed.resolved.syntax.budget.limits();
+        let project_limits = self.source.indexed.resolved.syntax.limits;
+        let expression_nodes = self.source.indexed.resolved.expressions.len();
+        let Self {
+            source,
+            desired,
+            names,
+            edits,
+        } = self;
+        drop(names);
+        drop(edits);
+        drop(source);
+        Ok(PendingRename {
+            bundle,
+            limits,
+            project_limits,
+            retained,
+            expression_nodes,
+            desired,
+        })
+    }
+}
+
+fn output_slots(bundle: &SourceBundle, total: usize) -> Result<Slots, TypedError> {
+    let mut text = add(total, bundle.entry.len(), Span::default())?;
+    for path in bundle.files.keys() {
+        text = add(text, path.len(), Span::default())?;
+    }
+    Ok(Slots {
+        entries: bundle.files.len(),
+        occurrences: 0,
+        text,
+    })
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename/emission/tests.rs

@@ -0,0 +1,646 @@
+use super::*;
+use crate::Layer;
+use crate::language::ParseLimits;
+use crate::language::analysis_source::mixed::{parse_with_profile, project};
+use project::tests::{accepted, id, rich_bundle, rich_model, single};
+
+fn authored(bundle: &SourceBundle) -> AuthoredMixedProject<'_> {
+    accepted(bundle).index().unwrap().index_ordinary().unwrap()
+}
+fn profile(entries: usize, bytes: usize) -> Limits {
+    Limits {
+        entries,
+        bytes,
+        ..Limits::source8(ParseLimits::UNLIMITED)
+    }
+}
+fn limited(
+    bundle: &SourceBundle,
+    limits: Limits,
+    policy: ProjectLimits,
+) -> AuthoredMixedProject<'_> {
+    project::resolve(parse_with_profile(bundle, policy, limits).unwrap())
+        .unwrap()
+        .index()
+        .unwrap()
+        .index_ordinary()
+        .unwrap()
+}
+fn chain() -> SourceBundle {
+    let mut b = single("include \"part.arcadia\";");
+    b.files.insert(
+        "part.arcadia".into(),
+        "include \"last.arcadia\";\r\n".into(),
+    );
+    b.files.insert("last.arcadia".into(), "//é\r\n".into());
+    b
+}
+fn failure<T>(result: Result<T, Failure>, text: &str) -> Failure {
+    let e = match result {
+        Ok(_) => panic!("unexpected success"),
+        Err(e) => e,
+    };
+    assert_eq!(e.diagnostics.len(), 1);
+    assert!(e.diagnostics[0].diagnostic.message.contains(text), "{e:?}");
+    e
+}
+fn same_policy(output: &PendingRename<'_>, limits: Limits, policy: ProjectLimits) {
+    let a = output.limits;
+    assert_eq!(
+        [a.bytes, a.tokens, a.entries, a.references, a.frames],
+        [
+            limits.bytes,
+            limits.tokens,
+            limits.entries,
+            limits.references,
+            limits.frames
+        ]
+    );
+    assert_eq!(a.numeric_units, limits.numeric_units);
+    let a = output.project_limits;
+    assert_eq!(
+        [
+            a.max_files,
+            a.max_include_depth,
+            a.max_include_edges,
+            a.model.max_source_bytes,
+            a.model.max_graph_objects,
+            a.model.max_records,
+            a.model.max_step_references
+        ],
+        [
+            policy.max_files,
+            policy.max_include_depth,
+            policy.max_include_edges,
+            policy.model.max_source_bytes,
+            policy.model.max_graph_objects,
+            policy.model.max_records,
+            policy.model.max_step_references
+        ]
+    );
+}
+const NEXT: &str =
+    "arcadia 8;\nproject next \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\n\n}\n";
+const NEXT_CHAIN: &str = "arcadia 8;\nproject next \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\ninclude \"part.arcadia\";\n}\n";
+#[test]
+fn exact_real_single_and_chain_overlap_caps_and_complete_owned_bytes() {
+    for (bundle, entries, bytes, before, output_entries, output_text, expected) in [
+        (
+            single(""),
+            17,
+            114,
+            Slots {
+                entries: 16,
+                occurrences: 0,
+                text: 9,
+            },
+            1,
+            105,
+            NEXT,
+        ),
+        (
+            chain(),
+            29,
+            216,
+            Slots {
+                entries: 26,
+                occurrences: 0,
+                text: 33,
+            },
+            3,
+            183,
+            NEXT_CHAIN,
+        ),
+    ] {
+        for (entry_cap, byte_cap, success) in [
+            (entries, bytes, true),
+            (entries - 1, bytes, false),
+            (entries, bytes - 1, false),
+        ] {
+            let limits = profile(entry_cap, byte_cap);
+            let policy = ProjectLimits::default();
+            let source = limited(&bundle, limits, policy);
+            let mut desired = source.project().clone();
+            desired.alias = "next".into();
+            let plan = source.plan_rename(&desired).unwrap();
+            assert_eq!(plan.source.indexed.resolved.storage.live, before);
+            let result = plan.emit_changed_unverified(&bundle);
+            if success {
+                let output = result.unwrap();
+                assert_eq!(
+                    output.retained,
+                    Slots {
+                        entries: output_entries,
+                        occurrences: 0,
+                        text: output_text
+                    }
+                );
+                assert_eq!(output.bundle.entry, "main.arcadia");
+                let mut expected_files = BTreeMap::from([("main.arcadia".into(), expected.into())]);
+                if output_entries == 3 {
+                    expected_files.insert(
+                        "part.arcadia".into(),
+                        "include \"last.arcadia\";\r\n".into(),
+                    );
+                    expected_files.insert("last.arcadia".into(), "//é\r\n".into());
+                }
+                assert_eq!(output.bundle.files, expected_files);
+                assert_eq!(output.expression_nodes, 0);
+                assert!(std::ptr::eq(output.desired, &desired));
+                same_policy(&output, limits, policy);
+            } else {
+                let e = failure(result, "limit exceeded");
+                assert_eq!(e.diagnostics[0].path, "main.arcadia");
+                assert_eq!(e.diagnostics[0].diagnostic.span, Span::default());
+            }
+        }
+    }
+}
+#[test]
+fn noop_returns_identical_owner_below_output_overlap_and_releases_desired_borrow() {
+    for (bundle, entries, bytes) in [(single(""), 16, 78), (chain(), 26, 132)] {
+        let source = limited(&bundle, profile(entries, bytes), ProjectLimits::default());
+        let storage = source.indexed.resolved.storage.live;
+        let usage = source.indexed.resolved.syntax.budget.usage;
+        let numeric = source.indexed.resolved.syntax.budget.numeric_units();
+        let names = source.indexed.data.names.values().next().unwrap().as_ptr();
+        let warnings = source.warnings().to_vec();
+        let result = {
+            let desired = source.project().clone();
+            source
+                .plan_rename(&desired)
+                .unwrap()
+                .into_unchanged(&bundle)
+                .unwrap()
+        };
+        assert!(std::ptr::eq(result.bundle(), &bundle));
+        assert_eq!(
+            result.indexed.data.names.values().next().unwrap().as_ptr(),
+            names
+        );
+        assert_eq!(result.indexed.resolved.storage.live, storage);
+        assert_eq!(result.indexed.resolved.syntax.budget.usage, usage);
+        assert_eq!(
+            result.indexed.resolved.syntax.budget.numeric_units(),
+            numeric
+        );
+        assert_eq!(result.warnings(), warnings);
+    }
+}
+#[test]
+fn wrong_branches_and_complete_stale_current_refuse_before_output() {
+    let bundle = chain();
+    let original = authored(&bundle).project().clone();
+    let mut desired = original.clone();
+    desired.alias = "next".into();
+    failure(
+        authored(&bundle)
+            .plan_rename(&original)
+            .unwrap()
+            .emit_changed_unverified(&bundle),
+        "unchanged",
+    );
+    failure(
+        authored(&bundle)
+            .plan_rename(&desired)
+            .unwrap()
+            .into_unchanged(&bundle),
+        "changes names",
+    );
+    for case in 0..6 {
+        let mut current = bundle.clone();
+        match case {
+            0 => current.entry = "last.arcadia".into(),
+            1 => current.files.get_mut("last.arcadia").unwrap().push(' '),
+            2 => current.files.get_mut("main.arcadia").unwrap().push(' '),
+            3 => {
+                current.files.remove("last.arcadia");
+            }
+            4 => {
+                current.files.insert("extra.arcadia".into(), String::new());
+            }
+            _ => {
+                let text = current.files.remove("last.arcadia").unwrap();
+                current.files.insert("renamed.arcadia".into(), text);
+            }
+        }
+        failure(
+            authored(&bundle)
+                .plan_rename(&original)
+                .unwrap()
+                .into_unchanged(&current),
+            "Current complete bundle",
+        );
+        failure(
+            authored(&bundle)
+                .plan_rename(&desired)
+                .unwrap()
+                .emit_changed_unverified(&current),
+            "Current complete bundle",
+        );
+    }
+    let current = bundle.clone();
+    assert_eq!(
+        authored(&bundle)
+            .plan_rename(&desired)
+            .unwrap()
+            .emit_changed_unverified(&current)
+            .unwrap()
+            .bundle
+            .files["main.arcadia"],
+        NEXT_CHAIN
+    );
+}
+#[test]
+fn existing_edit_validation_runs_before_both_transitions() {
+    let bundle = single("");
+    let original = authored(&bundle).project().clone();
+    let mut desired = original.clone();
+    desired.alias = "next".into();
+    let mut plan = authored(&bundle).plan_rename(&desired).unwrap();
+    plan.edits.clear();
+    failure(
+        plan.emit_changed_unverified(&bundle),
+        "missing a required target token",
+    );
+    let mut plan = authored(&bundle).plan_rename(&original).unwrap();
+    plan.edits.insert((0, 19, 20), Target::Global(id(1)));
+    failure(plan.into_unchanged(&bundle), "unchanged name");
+    let mut plan = authored(&bundle).plan_rename(&desired).unwrap();
+    plan.edits.clear();
+    plan.edits
+        .insert((0, usize::MAX, usize::MAX), Target::Global(id(1)));
+    failure(plan.emit_changed_unverified(&bundle), "nonempty");
+    // Arithmetic-only fault injection, not a real bundle large enough to overflow.
+    assert!(output_slots(&bundle, usize::MAX).is_err());
+}
+#[test]
+fn exact_all_policy_fields_and_pending_outlives_original_bundle() {
+    let desired = {
+        let b = single("");
+        let mut p = authored(&b).project().clone();
+        p.alias = "next".into();
+        p
+    };
+    let limits = Limits {
+        bytes: 2048,
+        tokens: 101,
+        entries: 99,
+        references: 31,
+        frames: 17,
+        numeric_units: 8192,
+    };
+    let policy = ProjectLimits {
+        max_files: 7,
+        max_include_depth: 3,
+        max_include_edges: 5,
+        model: ParseLimits {
+            max_source_bytes: 3000,
+            max_graph_objects: 67,
+            max_records: 123,
+            max_step_references: 37,
+        },
+    };
+    let pending = {
+        let b = single("");
+        limited(&b, limits, policy)
+            .plan_rename(&desired)
+            .unwrap()
+            .emit_changed_unverified(&b)
+            .unwrap()
+    };
+    assert_eq!(pending.bundle.files["main.arcadia"], NEXT);
+    same_policy(&pending, limits, policy);
+}
+#[test]
+fn scoped_small_stack_changed_unchanged_and_failure_drop() {
+    let bundle = single("");
+    let original = authored(&bundle).project().clone();
+    let mut changed = original.clone();
+    changed.alias = "next".into();
+    std::thread::scope(|scope| {
+        for mode in 0..3 {
+            let plan = limited(
+                &bundle,
+                profile(17, if mode == 2 { 113 } else { 114 }),
+                ProjectLimits::default(),
+            )
+            .plan_rename(if mode == 1 { &original } else { &changed })
+            .unwrap();
+            let b = &bundle;
+            std::thread::Builder::new()
+                .stack_size(128 * 1024)
+                .spawn_scoped(scope, move || {
+                    if mode == 1 {
+                        let owner = plan.into_unchanged(b).unwrap();
+                        assert!(std::ptr::eq(owner.bundle(), b));
+                        drop(owner);
+                    } else if mode == 0 {
+                        let pending = plan.emit_changed_unverified(b).unwrap();
+                        assert_eq!(pending.bundle.files["main.arcadia"], NEXT);
+                        drop(pending);
+                    } else {
+                        drop(failure(plan.emit_changed_unverified(b), "limit exceeded"));
+                    }
+                })
+                .unwrap()
+                .join()
+                .unwrap();
+        }
+    });
+    for (expression, result, nodes) in [
+        (
+            format!("{}1{}", "abs(".repeat(127), ")".repeat(127)),
+            "Number",
+            128,
+        ),
+        (
+            format!("[{}]", vec!["1"; 128].join(", ")),
+            "List(Number)",
+            129,
+        ),
+    ] {
+        let body = format!(
+            "calculation c \"C\" id \"00000000-0000-0000-0000-000000000002\" {{ result {result}; body {expression}; }}"
+        );
+        let bundle = single(&body);
+        let before = bundle.clone();
+        let expected = format!(
+            "arcadia 8;\nproject next \"Project\" id \"00000000-0000-0000-0000-000000000001\" {{\n{body}\n}}\n"
+        );
+        for changed in [false, true] {
+            // Complete prerequisites stay outside the bounded emitter worker.
+            let source = authored(&bundle);
+            assert_eq!(source.indexed.resolved.expressions.len(), nodes);
+            let mut desired = source.project().clone();
+            if changed {
+                desired.alias = "next".into();
+            }
+            let plan = source.plan_rename(&desired).unwrap();
+            std::thread::scope(|scope| {
+                let bundle = &bundle;
+                let expected = &expected;
+                std::thread::Builder::new()
+                    .stack_size(128 * 1024)
+                    .spawn_scoped(scope, move || {
+                        if changed {
+                            let pending = plan.emit_changed_unverified(bundle).unwrap();
+                            assert_eq!(pending.expression_nodes, nodes);
+                            assert_eq!(&pending.bundle.files["main.arcadia"], expected);
+                            drop(pending);
+                        } else {
+                            let owner = plan.into_unchanged(bundle).unwrap();
+                            assert!(std::ptr::eq(owner.bundle(), bundle));
+                            assert_eq!(owner.indexed.resolved.expressions.len(), nodes);
+                            drop(owner);
+                        }
+                    })
+                    .unwrap()
+                    .join()
+                    .unwrap();
+            });
+            assert_eq!(bundle, before);
+        }
+    }
+}
+fn rich_desired(layer: Layer) -> Project {
+    let mut p = rich_model(layer);
+    p.alias = "w".into();
+    p.elements.get_mut(&id(2)).unwrap().alias = "p".into();
+    p.elements.get_mut(&id(3)).unwrap().alias = "n".into();
+    let d = p.diagrams.get_mut(&id(5)).unwrap();
+    d.alias = "z".into();
+    d.nodes.get_mut(&id(4)).unwrap().alias = "v".into();
+    for (n, name) in [(10, "g"), (11, "f")] {
+        let def = p.definitions.get_mut(&id(n)).unwrap();
+        def.alias = name.into();
+        let crate::analysis::DefinitionBody::Calculation(c) = &mut def.body else {
+            panic!("calculation")
+        };
+        c.parameters[0].name = "y".into();
+        c.parameters[1].name = "x".into();
+    }
+    if layer == Layer::Sa {
+        p.elements.get_mut(&id(6)).unwrap().alias = "u".into();
+    }
+    p
+}
+// Independently authored entire expected files: no edit iterator or output text
+// contributes to these strings. The LF/CRLF transform applies to whole literals.
+const RICH_A: &str = "calculation g \"F\" id \"00000000-0000-0000-0000-000000000010\" {\ninput y id \"00000000-0000-0000-0000-000000000001\" : Number;\ninput x id \"00000000-0000-0000-0000-000000000012\" : Number;\nresult Number; body $y + $x;\n}\n";
+const RICH_B: &str = "calculation f \"G\" id \"00000000-0000-0000-0000-000000000011\" {\ninput y id \"00000000-0000-0000-0000-000000000001\" : Number;\ninput x id \"00000000-0000-0000-0000-000000000012\" : Number;\nresult Number; body $y - $x;\n}\n";
+fn rich_expected(layer: Layer) -> SourceBundle {
+    let (property, work, diagram, extra) = if layer == Layer::Oa {
+        ("oa_property", "oa_activity", "", "")
+    } else {
+        (
+            "sa_property",
+            "sa_function",
+            "layer Sa;",
+            "sa_system u \"System\" id \"00000000-0000-0000-0000-000000000006\" {}",
+        )
+    };
+    SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([
+            ("a.arcadia".into(), RICH_A.into()),
+            ("b.arcadia".into(), RICH_B.into()),
+            (
+                "main.arcadia".into(),
+                format!(
+                    "arcadia 8;\nproject w \"Project\" id \"00000000-0000-0000-0000-000000000001\" {{\ninclude \"b.arcadia\"; include \"a.arcadia\";\nnode v id \"00000000-0000-0000-0000-000000000004\" {{ diagram @z; element @n; }}\n{property} n \"Value\" id \"00000000-0000-0000-0000-000000000003\" {{ subject @p; type Number; base @g(x: 2, y: @f(y: 3, x: 4)) + @g(y: 5, x: 6); }}\n{work} p \"Work\" id \"00000000-0000-0000-0000-000000000002\" {{}}\ndiagram z \"Diagram\" id \"00000000-0000-0000-0000-000000000005\" {{ {diagram} }}\n{extra}\n}}\n"
+                ),
+            ),
+        ]),
+    }
+}
+#[test]
+fn whole_rich_oa_sa_scoped_global_swaps_and_unicode_crlf_bytes() {
+    for (layer, bytes, unicode_bytes) in [(Layer::Oa, 900, 943), (Layer::Sa, 974, 1017)] {
+        for unicode in [false, true] {
+            let mut bundle = rich_bundle(layer);
+            let mut expected = rich_expected(layer);
+            if unicode {
+                for text in bundle.files.values_mut() {
+                    *text = format!("// 雨\r\n{}", text.replace('\n', "\r\n"));
+                }
+                for text in expected.files.values_mut() {
+                    *text = format!("// 雨\r\n{}", text.replace('\n', "\r\n"));
+                }
+            }
+            let desired = rich_desired(layer);
+            let source = authored(&bundle);
+            let original_project = source.project().clone();
+            let pending = source
+                .plan_rename(&desired)
+                .unwrap()
+                .emit_changed_unverified(&bundle)
+                .unwrap();
+            assert_eq!(pending.bundle, expected);
+            assert_eq!(pending.expression_nodes, 15);
+            let count = if unicode { unicode_bytes } else { bytes };
+            assert_eq!(
+                pending.retained,
+                Slots {
+                    entries: 3,
+                    occurrences: 0,
+                    text: count + 42
+                }
+            );
+            assert_eq!(authored(&bundle).project(), &original_project);
+            assert_eq!(desired, rich_desired(layer));
+        }
+    }
+}
+#[test]
+fn four_file_cross_family_swap_preserves_entire_untouched_file_and_comments() {
+    let bundle=SourceBundle {entry:"main.arcadia".into(),files:BTreeMap::from([
+        ("a.arcadia".into(),"calculation f \"F\" id \"00000000-0000-0000-0000-000000000010\" { result Number; body 1; }\r\n".into()),
+        ("b.arcadia".into(),"// f and w are comments\r\noa_activity w \"Work\" id \"00000000-0000-0000-0000-000000000002\" {}\r\n".into()),
+        ("main.arcadia".into(),"// 雨\r\narcadia 8;\r\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\r\ninclude \"a.arcadia\"; include \"b.arcadia\"; include \"untouched.arcadia\";\r\noa_property v \"Value\" id \"00000000-0000-0000-0000-000000000003\" { subject @w; type Number; base @f(); }\r\n}\r\n".into()),
+        ("untouched.arcadia".into(),"// 雪 untouched f w\r\n".into()),
+    ])};
+    let expected=SourceBundle {entry:"main.arcadia".into(),files:BTreeMap::from([
+        ("a.arcadia".into(),"calculation w \"F\" id \"00000000-0000-0000-0000-000000000010\" { result Number; body 1; }\r\n".into()),
+        ("b.arcadia".into(),"// f and w are comments\r\noa_activity f \"Work\" id \"00000000-0000-0000-0000-000000000002\" {}\r\n".into()),
+        ("main.arcadia".into(),"// 雨\r\narcadia 8;\r\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\r\ninclude \"a.arcadia\"; include \"b.arcadia\"; include \"untouched.arcadia\";\r\noa_property v \"Value\" id \"00000000-0000-0000-0000-000000000003\" { subject @f; type Number; base @w(); }\r\n}\r\n".into()),
+        ("untouched.arcadia".into(),"// 雪 untouched f w\r\n".into()),
+    ])};
+    let source = authored(&bundle);
+    let mut desired = source.project().clone();
+    desired.definitions.get_mut(&id(10)).unwrap().alias = "w".into();
+    desired.elements.get_mut(&id(2)).unwrap().alias = "f".into();
+    let pending = source
+        .plan_rename(&desired)
+        .unwrap()
+        .emit_changed_unverified(&bundle)
+        .unwrap();
+    assert_eq!(pending.bundle, expected);
+    assert_eq!(
+        pending.retained,
+        Slots {
+            entries: 4,
+            occurrences: 0,
+            text: 526
+        }
+    );
+    assert_eq!(pending.expression_nodes, 2);
+}
+const CATEGORY_EXPECTED: &str = r#"arcadia 8;
+project a "Authored @p child" id "00000000-0000-0000-0000-000000000001" {
+    description "Do not index @child, @link or uuid in prose 雨";
+    oa_activity p "Parent child" id "00000000-0000-0000-0000-000000000002" {
+        oa_activity implicit "Explicit child" id "00000000-0000-0000-0000-000000000003" { parent @ // @noise child
+  p; }
+        oa_activity child "Implicit child" id "00000000-0000-0000-0000-000000000004" { description "child @a"; }
+    }
+    sa_function link "Selected" id "00000000-0000-0000-0000-000000000005" {}
+    interaction s "Link" id "00000000-0000-0000-0000-000000000006" { source @implicit; target @child; }
+    diagram note "View" id "00000000-0000-0000-0000-000000000007" {
+        routes [{ edge @s; }];
+        view_options { hidden_edges [@s]; };
+    }
+    artifact d "Evidence" id "00000000-0000-0000-0000-000000000008" { owner @s; uri "docs/@child.md"; }
+    trace q "Review" id "00000000-0000-0000-0000-000000000009" {
+        oa @implicit; sa @link; kind Manual;
+        baseline {
+            oa { name "child"; description "@child"; };
+            sa { name "s"; description "@s"; };
+            semantic { facets [{ Field { Type { oa { Value { Named uuid "00000000-0000-0000-0000-000000000003"; }; }; sa { Value Boolean; }; }; }; }]; };
+        };
+    }
+    oa_process t "Caller" id "00000000-0000-0000-0000-000000000010" { steps [@sub, @left]; }
+    oa_process use "Callee" id "00000000-0000-0000-0000-000000000011" { steps [@right]; }
+    oa_occurrence sub "Call" id "00000000-0000-0000-0000-000000000012" { parent @t; body { SequenceReference { sequence @use; }; }; }
+    oa_occurrence right "Left" id "00000000-0000-0000-0000-000000000013" { parent @use; body { Action { action @implicit; lifeline none; }; }; }
+    oa_occurrence left "Right" id "00000000-0000-0000-0000-000000000014" { parent @t; body { Action { action @child; lifeline none; }; }; }
+    contextual_link ctx "Context" id "00000000-0000-0000-0000-000000000015" { owner @t; source { references [@sub]; occurrence @right; }; target { references []; occurrence @left; }; purpose { Precedence { guard "@child"; }; }; }
+}
+"#;
+#[test]
+fn complete_categories_preserve_trivia_implicit_parent_and_historical_uuid_bytes() {
+    let bundle = SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([(
+            "main.arcadia".into(),
+            include_str!("../../tests/fixtures/categories.arcadia").into(),
+        )]),
+    };
+    let source = authored(&bundle);
+    let mut desired = source.project().clone();
+    let replacements = [
+        "a", "p", "implicit", "child", "link", "s", "note", "d", "q", "t", "use", "sub", "right",
+        "left", "ctx",
+    ];
+    desired.alias = "a".into();
+    for e in desired.elements.values_mut() {
+        e.alias = replacements[(1..=15).find(|n| id(*n) == e.id).unwrap() - 1].into();
+    }
+    for r in desired.relations.values_mut() {
+        r.alias = replacements[(1..=15).find(|n| id(*n) == r.id).unwrap() - 1].into();
+    }
+    desired.diagrams.get_mut(&id(7)).unwrap().alias = "note".into();
+    desired.artifact_links.get_mut(&id(8)).unwrap().alias = "d".into();
+    desired.traces.get_mut(&id(9)).unwrap().alias = "q".into();
+    let pending = source
+        .plan_rename(&desired)
+        .unwrap()
+        .emit_changed_unverified(&bundle)
+        .unwrap();
+    let expected = SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([(
+            "main.arcadia".into(),
+            format!(
+                "{}\r\n",
+                CATEGORY_EXPECTED
+                    .trim_end_matches('\n')
+                    .replace("@noise child\n", "@noise child\r\n")
+            ),
+        )]),
+    };
+    assert_eq!(pending.bundle, expected);
+    assert_eq!(
+        pending.retained,
+        Slots {
+            entries: 1,
+            occurrences: 0,
+            text: 2169
+        }
+    );
+    assert_eq!(pending.expression_nodes, 0);
+}
+#[test]
+fn combined_growth_shrinkage_emits_original_coordinates_and_complete_untouched_file() {
+    let mut bundle = rich_bundle(Layer::Oa);
+    *bundle.files.get_mut("main.arcadia").unwrap() =
+        bundle.files["main.arcadia"].replace("node n ", "node nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn ");
+    let source = authored(&bundle);
+    let mut desired = source.project().clone();
+    desired
+        .diagrams
+        .get_mut(&id(5))
+        .unwrap()
+        .nodes
+        .get_mut(&id(4))
+        .unwrap()
+        .alias = "n".into();
+    desired.definitions.get_mut(&id(10)).unwrap().alias = "renamed_f".into();
+    let expected=SourceBundle {entry:"main.arcadia".into(),files:BTreeMap::from([
+        ("a.arcadia".into(),"calculation renamed_f \"F\" id \"00000000-0000-0000-0000-000000000010\" {\ninput x id \"00000000-0000-0000-0000-000000000001\" : Number;\ninput y id \"00000000-0000-0000-0000-000000000012\" : Number;\nresult Number; body $x + $y;\n}\n".into()),
+        ("b.arcadia".into(),"calculation g \"G\" id \"00000000-0000-0000-0000-000000000011\" {\ninput x id \"00000000-0000-0000-0000-000000000001\" : Number;\ninput y id \"00000000-0000-0000-0000-000000000012\" : Number;\nresult Number; body $x - $y;\n}\n".into()),
+        ("main.arcadia".into(),"arcadia 8;\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\ninclude \"b.arcadia\"; include \"a.arcadia\";\nnode n id \"00000000-0000-0000-0000-000000000004\" { diagram @d; element @v; }\noa_property v \"Value\" id \"00000000-0000-0000-0000-000000000003\" { subject @w; type Number; base @renamed_f(y: 2, x: @g(x: 3, y: 4)) + @renamed_f(x: 5, y: 6); }\noa_activity w \"Work\" id \"00000000-0000-0000-0000-000000000002\" {}\ndiagram d \"Diagram\" id \"00000000-0000-0000-0000-000000000005\" {  }\n\n}\n".into()),
+    ])};
+    let plan = source.plan_rename(&desired).unwrap();
+    assert_eq!(plan.output_bytes().unwrap(), 924);
+    let pending = plan.emit_changed_unverified(&bundle).unwrap();
+    assert_eq!(pending.bundle, expected);
+    assert_eq!(
+        pending.retained,
+        Slots {
+            entries: 3,
+            occurrences: 0,
+            text: 966
+        }
+    );
+}

crates/oa-core/src/language/analysis_source/mixed/project/ordinary_index/rename/tests.rs

@@ -0,0 +1,982 @@
+use super::super::super::tests::{accepted, id, rich_bundle, rich_model, single};
+use super::*;
+use crate::language::analysis_source::budget::Limits;
+use crate::language::analysis_source::mixed::parse_with_profile;
+use crate::source_project::ProjectLimits;
+use crate::{Layer, analysis as a};
+
+fn authored(bundle: &SourceBundle) -> AuthoredMixedProject<'_> {
+    accepted(bundle).index().unwrap().index_ordinary().unwrap()
+}
+fn calculation(p: &mut Project, n: usize) -> &mut a::CalculationDefinition {
+    let a::DefinitionBody::Calculation(c) = &mut p.definitions.get_mut(&id(n)).unwrap().body else {
+        panic!("calculation")
+    };
+    c
+}
+fn renamed(layer: Layer) -> Project {
+    let mut p = rich_model(layer);
+    p.alias = "w".into();
+    p.elements.get_mut(&id(2)).unwrap().alias = "p".into();
+    p.elements.get_mut(&id(3)).unwrap().alias = "n".into();
+    let d = p.diagrams.get_mut(&id(5)).unwrap();
+    d.alias = "z".into();
+    d.nodes.get_mut(&id(4)).unwrap().alias = "v".into();
+    for (n, name) in [(10, "g"), (11, "f")] {
+        p.definitions.get_mut(&id(n)).unwrap().alias = name.into();
+        let c = calculation(&mut p, n);
+        c.parameters[0].name = "y".into();
+        c.parameters[1].name = "x".into();
+    }
+    if layer == Layer::Sa {
+        p.elements.get_mut(&id(6)).unwrap().alias = "u".into();
+    }
+    p
+}
+fn rejected(bundle: &SourceBundle, desired: &Project, contains: &str) {
+    let e = match authored(bundle).plan_rename(desired) {
+        Ok(_) => panic!("unexpected accepted target"),
+        Err(e) => e,
+    };
+    assert_eq!(e.diagnostics.len(), 1);
+    assert!(
+        e.diagnostics[0].diagnostic.message.contains(contains),
+        "{:?}",
+        e
+    );
+}
+#[test]
+fn noop_borrows_exact_target_and_preserves_source_usage_and_storage() {
+    let bundle = rich_bundle(Layer::Oa);
+    let source = authored(&bundle);
+    let desired = rich_model(Layer::Oa);
+    let before = source.indexed.resolved.storage.live;
+    let usage = source.indexed.resolved.syntax.budget.usage;
+    let numeric = source.indexed.resolved.syntax.budget.numeric_units();
+    let plan = source.plan_rename(&desired).unwrap();
+    assert!(std::ptr::eq(plan.desired(), &desired));
+    assert!(std::ptr::eq(plan.source().bundle(), &bundle));
+    assert!(plan.edits().is_empty());
+    assert!(plan.changed_names().is_empty());
+    assert_eq!(plan.source.indexed.resolved.storage.live, before);
+    assert_eq!(plan.source.indexed.resolved.syntax.budget.usage, usage);
+    assert_eq!(
+        plan.source.indexed.resolved.syntax.budget.numeric_units(),
+        numeric
+    );
+    assert_eq!(desired, rich_model(Layer::Oa));
+    assert_eq!(plan.source.project(), &desired);
+    assert_eq!(plan.output_bytes().unwrap(), 900);
+}
+#[test]
+fn final_names_reject_unchanged_collisions_invalid_names_and_scoped_collisions() {
+    let bundle = rich_bundle(Layer::Oa);
+    for alias in ["w", "", "雨", "project", "bad-name"] {
+        let mut desired = rich_model(Layer::Oa);
+        desired.alias = alias.into();
+        rejected(
+            &bundle,
+            &desired,
+            if alias == "w" { "collide" } else { "Invalid" },
+        );
+    }
+    let mut desired = rich_model(Layer::Oa);
+    calculation(&mut desired, 10).parameters[0].name = "y".into();
+    rejected(&bundle, &desired, "collide");
+    let mut desired = rich_model(Layer::Oa);
+    calculation(&mut desired, 10).parameters[0].name = "p".into();
+    calculation(&mut desired, 11).parameters[0].name = "p".into();
+    let plan = authored(&bundle).plan_rename(&desired).unwrap();
+    assert_eq!(plan.changed_names().len(), 2);
+}
+#[test]
+fn complete_model_gate_rejects_identity_collection_parameter_and_payload_changes() {
+    let bundle = rich_bundle(Layer::Oa);
+    type Mutation = Box<dyn Fn(&mut Project)>;
+    let mutations: Vec<Mutation> = vec![
+        Box::new(|p| p.schema_version = 7),
+        Box::new(|p| p.id = id(99)),
+        Box::new(|p| p.name.push('!')),
+        Box::new(|p| p.description.push('!')),
+        Box::new(|p| {
+            p.elements.remove(&id(2));
+        }),
+        Box::new(|p| {
+            let e = p.elements.remove(&id(2)).unwrap();
+            p.elements.insert(id(99), e);
+        }),
+        Box::new(|p| p.elements.get_mut(&id(2)).unwrap().id = id(99)),
+        Box::new(|p| p.elements.get_mut(&id(2)).unwrap().name.push('!')),
+        Box::new(|p| p.elements.get_mut(&id(2)).unwrap().description.push('!')),
+        Box::new(|p| p.elements.get_mut(&id(2)).unwrap().parent = Some(id(3))),
+        Box::new(|p| {
+            p.elements.get_mut(&id(2)).unwrap().body =
+                crate::ElementBody::Sa(crate::SaBody::Function)
+        }),
+        Box::new(|p| p.definitions.get_mut(&id(10)).unwrap().id = id(99)),
+        Box::new(|p| p.definitions.get_mut(&id(10)).unwrap().name.push('!')),
+        Box::new(|p| {
+            p.definitions
+                .get_mut(&id(10))
+                .unwrap()
+                .description
+                .push('!')
+        }),
+        Box::new(|p| calculation(p, 10).parameters.swap(0, 1)),
+        Box::new(|p| {
+            calculation(p, 10).parameters.pop();
+        }),
+        Box::new(|p| {
+            let q = calculation(p, 10).parameters[0].clone();
+            calculation(p, 10).parameters.push(q);
+        }),
+        Box::new(|p| calculation(p, 10).parameters[0].id = a::ParameterId(id(99))),
+        Box::new(|p| {
+            calculation(p, 10).parameters[0].value_type =
+                a::AnalysisType::Scalar(a::ScalarType::Boolean)
+        }),
+        Box::new(|p| calculation(p, 10).result = a::AnalysisType::Scalar(a::ScalarType::Boolean)),
+        Box::new(|p| calculation(p, 10).body = a::Binding::Unbound),
+        Box::new(|p| p.diagrams.get_mut(&id(5)).unwrap().id = id(99)),
+        Box::new(|p| p.diagrams.get_mut(&id(5)).unwrap().name.push('!')),
+        Box::new(|p| p.diagrams.get_mut(&id(5)).unwrap().description.push('!')),
+        Box::new(|p| p.diagrams.get_mut(&id(5)).unwrap().layer = Layer::Sa),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .view_options
+                .hidden_edges
+                .push(id(99))
+        }),
+        Box::new(|p| {
+            p.diagrams.get_mut(&id(5)).unwrap().nodes.clear();
+        }),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .nodes
+                .get_mut(&id(4))
+                .unwrap()
+                .id = id(99)
+        }),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .nodes
+                .get_mut(&id(4))
+                .unwrap()
+                .element = id(2)
+        }),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .nodes
+                .get_mut(&id(4))
+                .unwrap()
+                .position
+                .x = 1.
+        }),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .nodes
+                .get_mut(&id(4))
+                .unwrap()
+                .size
+                .width = 1.
+        }),
+        Box::new(|p| {
+            p.diagrams
+                .get_mut(&id(5))
+                .unwrap()
+                .nodes
+                .get_mut(&id(4))
+                .unwrap()
+                .collapsed = true
+        }),
+    ];
+    for mutate in mutations {
+        let mut p = rich_model(Layer::Oa);
+        mutate(&mut p);
+        rejected(&bundle, &p, "non-name");
+    }
+}
+#[test]
+fn complete_current_bundle_rejects_entry_paths_missing_extra_and_untouched_bytes() {
+    let bundle = rich_bundle(Layer::Oa);
+    let mut desired = rich_model(Layer::Oa);
+    desired.alias = "renamed".into();
+    let plan = authored(&bundle).plan_rename(&desired).unwrap();
+    plan.validate_current(&bundle).unwrap();
+    for case in 0..6 {
+        let mut current = bundle.clone();
+        match case {
+            0 => current.entry = "a.arcadia".into(),
+            1 => {
+                current.files.remove("a.arcadia");
+            }
+            2 => {
+                current.files.insert("extra.arcadia".into(), String::new());
+            }
+            3 => current.files.get_mut("a.arcadia").unwrap().push(' '),
+            4 => current.files.get_mut("main.arcadia").unwrap().push(' '),
+            _ => {
+                let s = current.files.remove("a.arcadia").unwrap();
+                current.files.insert("renamed.arcadia".into(), s);
+            }
+        }
+        assert!(plan.validate_current(&current).is_err());
+    }
+}
+#[test]
+fn exact_merged_map_cap_passes_all_predecessors_and_retains_r_plus_m() {
+    let bundle = rich_bundle(Layer::Oa);
+    let desired = renamed(Layer::Oa);
+    let baseline = authored(&bundle).indexed.resolved.storage.live;
+    for (extra, fits) in [(37, false), (38, true)] {
+        let profile = Limits {
+            entries: baseline.entries + extra,
+            ..Limits::source8(language::ParseLimits::UNLIMITED)
+        };
+        let source =
+            resolve(parse_with_profile(&bundle, ProjectLimits::default(), profile).unwrap())
+                .unwrap()
+                .index()
+                .unwrap()
+                .index_ordinary()
+                .unwrap();
+        assert_eq!(source.indexed.resolved.storage.live, baseline);
+        let result = source.plan_rename(&desired);
+        if fits {
+            let plan = result.unwrap();
+            assert_eq!(
+                plan.source.indexed.resolved.storage.live,
+                baseline.add(Slots::entries(38), Span::default()).unwrap()
+            );
+        } else {
+            let e = match result {
+                Ok(_) => panic!("cap accepted"),
+                Err(e) => e,
+            };
+            assert_eq!(
+                e.diagnostics[0].diagnostic.message,
+                "Source8 lowering entry limit exceeded."
+            );
+            assert_eq!(e.diagnostics[0].path, "main.arcadia");
+            assert_eq!(
+                e.diagnostics[0].diagnostic.span,
+                Span {
+                    start: 412,
+                    end: 413
+                }
+            );
+        }
+    }
+}
+#[test]
+fn damaged_complete_edits_fail_missing_extra_wrong_target_and_utf8_authority() {
+    let mut bundle = rich_bundle(Layer::Oa);
+    for s in bundle.files.values_mut() {
+        *s = format!("// 雨\r\n{s}");
+    }
+    let desired = renamed(Layer::Oa);
+    for case in 0..7 {
+        let mut plan = authored(&bundle).plan_rename(&desired).unwrap();
+        let key = *plan.edits.keys().next().unwrap();
+        match case {
+            0 => {
+                plan.edits.remove(&key);
+            }
+            1 => {
+                plan.edits.insert((0, 0, 1), Target::Global(id(10)));
+            }
+            2 => {
+                plan.edits.insert(key, Target::Global(id(11)));
+            }
+            3 => {
+                plan.edits.insert((0, 4, 5), Target::Global(id(10)));
+            }
+            4 => {
+                plan.edits
+                    .insert((99, key.1, key.2), Target::Global(id(10)));
+            }
+            5 => {
+                plan.edits
+                    .insert((0, key.1, key.2 + 1), Target::Global(id(10)));
+            }
+            _ => {
+                plan.edits.insert((0, key.1, key.1), Target::Global(id(10)));
+            }
+        }
+        let failure = plan.validate().unwrap_err();
+        assert_eq!(failure.diagnostics.len(), 1);
+        if case == 3 || case == 4 {
+            assert_eq!(failure.diagnostics[0].diagnostic.span, Span::default());
+            assert_eq!(
+                failure.diagnostics[0].path,
+                if case == 3 {
+                    "a.arcadia"
+                } else {
+                    "main.arcadia"
+                }
+            );
+        }
+        if case == 0 {
+            assert_eq!(failure.diagnostics[0].path, "a.arcadia");
+            assert_eq!(
+                failure.diagnostics[0].diagnostic.span,
+                Span { start: 20, end: 21 }
+            );
+            assert_eq!(
+                failure.diagnostics[0].diagnostic.message,
+                "Rename edit set is missing a required target token."
+            );
+        }
+    }
+}
+
+fn categories() -> SourceBundle {
+    SourceBundle {
+        entry: "main.arcadia".into(),
+        files: BTreeMap::from([(
+            "main.arcadia".into(),
+            include_str!("../tests/fixtures/categories.arcadia").into(),
+        )]),
+    }
+}
+#[test]
+fn every_ordinary_record_field_group_is_fixed_including_historical_payloads() {
+    let bundle = categories();
+    let original = authored(&bundle).project().clone();
+    type Mutation = Box<dyn Fn(&mut Project)>;
+    let changes: Vec<Mutation> = vec![
+        Box::new(|p| p.relations.get_mut(&id(6)).unwrap().id = id(99)),
+        Box::new(|p| p.relations.get_mut(&id(6)).unwrap().name.push('!')),
+        Box::new(|p| p.relations.get_mut(&id(6)).unwrap().description.push('!')),
+        Box::new(|p| {
+            let body = p.relations[&id(15)].body.clone();
+            p.relations.get_mut(&id(6)).unwrap().body = body;
+        }),
+        Box::new(|p| {
+            p.relations.remove(&id(6));
+        }),
+        Box::new(|p| {
+            p.diagrams.get_mut(&id(7)).unwrap().projection = crate::ProjectionKind::Allocation
+        }),
+        Box::new(|p| p.diagrams.get_mut(&id(7)).unwrap().routes.clear()),
+        Box::new(|p| {
+            p.diagrams.remove(&id(7));
+        }),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().id = id(99)),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().name.push('!')),
+        Box::new(|p| {
+            p.artifact_links
+                .get_mut(&id(8))
+                .unwrap()
+                .description
+                .push('!')
+        }),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().owner = id(3)),
+        Box::new(|p| {
+            p.artifact_links.get_mut(&id(8)).unwrap().relation = crate::ArtifactRelation::Verifies
+        }),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().uri.push('!')),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().revision = Some("changed".into())),
+        Box::new(|p| p.artifact_links.get_mut(&id(8)).unwrap().fragment = Some("changed".into())),
+        Box::new(|p| {
+            p.artifact_links.remove(&id(8));
+        }),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().id = id(99)),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().name.push('!')),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().description.push('!')),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().oa = id(4)),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().sa = id(4)),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().kind = crate::TraceKind::Refinement),
+        Box::new(|p| p.traces.get_mut(&id(9)).unwrap().baseline = None),
+        Box::new(|p| {
+            p.traces
+                .get_mut(&id(9))
+                .unwrap()
+                .baseline
+                .as_mut()
+                .unwrap()
+                .semantic = None
+        }),
+        Box::new(|p| {
+            p.traces
+                .get_mut(&id(9))
+                .unwrap()
+                .baseline
+                .as_mut()
+                .unwrap()
+                .oa
+                .name
+                .push('!')
+        }),
+        Box::new(|p| {
+            p.traces.remove(&id(9));
+        }),
+    ];
+    for change in changes {
+        let mut p = original.clone();
+        change(&mut p);
+        rejected(&bundle, &p, "non-name");
+    }
+    let source = authored(&bundle);
+    assert_eq!(source.indexed.resolved.expressions.len(), 0);
+    drop(source.plan_rename(&original).unwrap());
+}
+#[test]
+fn combined_shrink_offsets_typed_growth_and_counts_untouched_files() {
+    let mut bundle = rich_bundle(Layer::Oa);
+    let main = bundle.files.get_mut("main.arcadia").unwrap();
+    *main = main.replace("node n ", &format!("node {} ", "n".repeat(31)));
+    assert_eq!(bundle.files.values().map(String::len).sum::<usize>(), 930);
+    for (name, expected) in [("renamed_f", Some(924)), ("renamed_func", None)] {
+        let profile = Limits {
+            bytes: 930,
+            ..Limits::source8(language::ParseLimits::UNLIMITED)
+        };
+        let source =
+            resolve(parse_with_profile(&bundle, ProjectLimits::default(), profile).unwrap())
+                .unwrap()
+                .index()
+                .unwrap()
+                .index_ordinary()
+                .unwrap();
+        let mut desired = source.project().clone();
+        desired
+            .diagrams
+            .get_mut(&id(5))
+            .unwrap()
+            .nodes
+            .get_mut(&id(4))
+            .unwrap()
+            .alias = "n".into();
+        desired.definitions.get_mut(&id(10)).unwrap().alias = name.into();
+        let result = source.plan_rename(&desired);
+        if let Some(bytes) = expected {
+            let plan = result.unwrap();
+            assert_eq!(plan.output_bytes().unwrap(), bytes);
+            assert_eq!(plan.edits().len(), 4);
+        } else {
+            let e = match result {
+                Ok(_) => panic!("oversize accepted"),
+                Err(e) => e,
+            };
+            assert_eq!(
+                e.diagnostics[0].diagnostic.message,
+                "Source8 index/output byte limit exceeded."
+            );
+        }
+    }
+}
+#[test]
+fn deep_and_wide_equality_and_late_refusal_drop_on_small_stack() {
+    for (expression, result, nodes) in [
+        (
+            format!("{}1{}", "abs(".repeat(127), ")".repeat(127)),
+            "Number",
+            128,
+        ),
+        (
+            format!("[{}]", vec!["1"; 128].join(", ")),
+            "List(Number)",
+            129,
+        ),
+    ] {
+        let bundle = single(&format!(
+            "calculation c \"C\" id \"{}\" {{ result {result}; body {expression}; }}",
+            id(2)
+        ));
+        for mode in 0..3 {
+            // Admission/intent construction are prerequisites, outside the
+            // bounded planner worker. No limits or live owner state are reset.
+            let source = authored(&bundle);
+            assert_eq!(source.indexed.resolved.expressions.len(), nodes);
+            let mut desired = source.project().clone();
+            match mode {
+                0 => {}
+                1 => desired.definitions.get_mut(&id(2)).unwrap().alias = "p".into(),
+                _ => calculation(&mut desired, 2).body = a::Binding::Unbound,
+            }
+            std::thread::scope(|scope| {
+                let desired = &desired;
+                std::thread::Builder::new()
+                    .stack_size(128 * 1024)
+                    .spawn_scoped(scope, move || {
+                        // The complete owner moves into this worker; successful
+                        // plans and consumed failure owners die here. Nothing
+                        // carrying source/edit authority escapes the worker.
+                        match source.plan_rename(desired) {
+                            Ok(plan) => {
+                                assert_eq!(mode, 0, "mutation unexpectedly accepted");
+                                assert!(plan.edits().is_empty());
+                                assert!(std::ptr::eq(plan.desired(), desired));
+                                drop(plan);
+                            }
+                            Err(failure) => {
+                                assert_ne!(mode, 0, "unchanged target unexpectedly refused");
+                                assert_eq!(failure.diagnostics.len(), 1);
+                                assert_eq!(
+                                    failure.diagnostics[0].diagnostic.message,
+                                    if mode == 1 {
+                                        "Rename aliases collide in their final namespace."
+                                    } else {
+                                        "Rename target changes non-name project semantics."
+                                    }
+                                );
+                                drop(failure);
+                            }
+                        }
+                    })
+                    .unwrap()
+                    .join()
+                    .unwrap();
+            });
+            drop(desired);
+        }
+    }
+}
+#[test]
+fn zero_expression_original_rejects_target_only_deep_and_wide_variants() {
+    let bundle = single(&format!(
+        "calculation c \"C\" id \"{}\" {{ result Number; body unbound; }}",
+        id(2)
+    ));
+    let source = authored(&bundle);
+    assert_eq!(source.indexed.resolved.expressions.len(), 0);
+    let original = source.project().clone();
+    let mut deep = a::Expr::Boolean(true);
+    for _ in 0..2048 {
+        deep = a::Expr::Unary {
+            op: a::UnaryOp::Not,
+            operand: Box::new(deep),
+        };
+    }
+    for expression in [deep, a::Expr::List(vec![a::Expr::Boolean(true); 4096])] {
+        let mut desired = original.clone();
+        calculation(&mut desired, 2).body = a::Binding::Expression(expression);
+        rejected(&bundle, &desired, "non-name");
+    }
+}
+#[test]
+fn signed_zero_geometry_uses_existing_semantic_equality() {
+    let bundle = rich_bundle(Layer::Oa);
+    let mut desired = rich_model(Layer::Oa);
+    desired
+        .diagrams
+        .get_mut(&id(5))
+        .unwrap()
+        .nodes
+        .get_mut(&id(4))
+        .unwrap()
+        .position
+        .x = -0.;
+    assert!(
+        authored(&bundle)
+            .plan_rename(&desired)
+            .unwrap()
+            .edits()
+            .is_empty()
+    );
+}
+
+fn parameter(c: usize, p: usize) -> Target {
+    Target::Parameter {
+        calculation: id(c),
+        parameter: a::ParameterId(id(p)),
+    }
+}
+#[test]
+fn independent_entire_rich_maps_oa_sa_unicode_crlf_and_borrowed_names() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for crlf in [false, true] {
+            let mut bundle = rich_bundle(layer);
+            if crlf {
+                for source in bundle.files.values_mut() {
+                    *source = format!("// 雨\r\n{}", source.replace('\n', "\r\n"));
+                }
+            }
+            let desired = renamed(layer);
+            let source = authored(&bundle);
+            let before = source.indexed.resolved.storage.live;
+            let usage = source.indexed.resolved.syntax.budget.usage;
+            let plan = source.plan_rename(&desired).unwrap();
+            let mut names = BTreeMap::from([
+                (Target::Global(id(1)), "w"),
+                (Target::Global(id(2)), "p"),
+                (Target::Global(id(3)), "n"),
+                (Target::Global(id(4)), "v"),
+                (Target::Global(id(5)), "z"),
+                (Target::Global(id(10)), "g"),
+                (Target::Global(id(11)), "f"),
+                (parameter(10, 1), "y"),
+                (parameter(10, 12), "x"),
+                (parameter(11, 1), "y"),
+                (parameter(11, 12), "x"),
+            ]);
+            if layer == Layer::Sa {
+                names.insert(Target::Global(id(6)), "u");
+            }
+            let mut edits = BTreeMap::new();
+            let offsets = if crlf {
+                [20, 77, 138, 214, 219]
+            } else {
+                [12, 68, 128, 203, 208]
+            };
+            for (file, calculation) in [(0, 10), (1, 11)] {
+                for (start, target) in offsets.into_iter().zip([
+                    Target::Global(id(calculation)),
+                    parameter(calculation, 1),
+                    parameter(calculation, 12),
+                    parameter(calculation, 1),
+                    parameter(calculation, 12),
+                ]) {
+                    edits.insert((file, start, start + 1), target);
+                }
+            }
+            let offsets = if crlf {
+                [
+                    28, 133, 188, 200, 218, 281, 303, 305, 311, 315, 317, 323, 333, 335, 341, 363,
+                    426,
+                ]
+            } else {
+                [
+                    19, 122, 177, 189, 206, 269, 291, 293, 299, 303, 305, 311, 321, 323, 329, 350,
+                    412,
+                ]
+            };
+            let g = |n| Target::Global(id(n));
+            for (start, target) in offsets.into_iter().zip([
+                g(1),
+                g(4),
+                g(5),
+                g(3),
+                g(3),
+                g(2),
+                g(10),
+                parameter(10, 12),
+                parameter(10, 1),
+                g(11),
+                parameter(11, 1),
+                parameter(11, 12),
+                g(10),
+                parameter(10, 1),
+                parameter(10, 12),
+                g(2),
+                g(5),
+            ]) {
+                edits.insert((2, start, start + 1), target);
+            }
+            if layer == Layer::Sa {
+                let start = if crlf { 505 } else { 490 };
+                edits.insert((2, start, start + 1), g(6));
+            }
+            assert_eq!(plan.changed_names(), &names);
+            assert_eq!(plan.edits(), &edits);
+            let delta = if layer == Layer::Oa { 38 } else { 40 };
+            assert_eq!(
+                plan.source.indexed.resolved.storage.live,
+                before.add(Slots::entries(delta), Span::default()).unwrap()
+            );
+            assert_eq!(plan.source.indexed.resolved.syntax.budget.usage, usage);
+            assert!(std::ptr::eq(plan.desired(), &desired));
+            assert_eq!(desired, renamed(layer));
+            assert_eq!(plan.source.project(), &rich_model(layer));
+            assert!(std::ptr::eq(
+                plan.names[&g(1)].as_ptr(),
+                desired.alias.as_ptr()
+            ));
+            assert_eq!(
+                plan.output_bytes().unwrap(),
+                match (layer, crlf) {
+                    (Layer::Oa, false) => 900,
+                    (Layer::Oa, true) => 943,
+                    (Layer::Sa, false) => 974,
+                    (Layer::Sa, true) => 1017,
+                }
+            );
+        }
+    }
+}
+#[test]
+fn independent_entire_category_map_includes_comment_separated_refs_and_excludes_history() {
+    let bundle = categories();
+    let source = authored(&bundle);
+    let mut desired = source.project().clone();
+    let replacements = [
+        "a", "p", "implicit", "child", "link", "s", "note", "d", "q", "t", "use", "sub", "right",
+        "left", "ctx",
+    ];
+    desired.alias = replacements[0].into();
+    for e in desired.elements.values_mut() {
+        e.alias = replacements[(1..=15).find(|n| id(*n) == e.id).unwrap() - 1].into();
+    }
+    for r in desired.relations.values_mut() {
+        r.alias = replacements[(1..=15).find(|n| id(*n) == r.id).unwrap() - 1].into();
+    }
+    desired.diagrams.get_mut(&id(7)).unwrap().alias = "note".into();
+    desired.artifact_links.get_mut(&id(8)).unwrap().alias = "d".into();
+    desired.traces.get_mut(&id(9)).unwrap().alias = "q".into();
+    let before = source.indexed.resolved.storage.live;
+    assert_eq!(source.indexed.resolved.expressions.len(), 0);
+    let plan = source.plan_rename(&desired).unwrap();
+    let spans: &[(usize, &[(usize, usize)])] = &[
+        (1, &[(19, 20)]),
+        (2, &[(168, 169), (344, 345)]),
+        (3, &[(249, 254), (625, 630), (992, 997), (1741, 1746)]),
+        (4, &[(369, 377), (640, 648), (1882, 1890)]),
+        (5, &[(487, 488), (1003, 1004)]),
+        (6, &[(561, 565), (741, 745), (789, 793), (885, 889)]),
+        (7, &[(664, 665)]),
+        (8, &[(818, 822)]),
+        (9, &[(925, 926)]),
+        (
+            10,
+            &[(1328, 1329), (1577, 1578), (1855, 1856), (2004, 2005)],
+        ),
+        (11, &[(1422, 1425), (1617, 1620), (1712, 1715)]),
+        (12, &[(1391, 1394), (1514, 1517), (2029, 2032)]),
+        (13, &[(1487, 1491), (1648, 1652), (2047, 2051)]),
+        (14, &[(1397, 1402), (1789, 1794), (2092, 2097)]),
+        (15, &[(1935, 1942)]),
+    ];
+    let expected: BTreeMap<_, _> = spans
+        .iter()
+        .flat_map(|(n, spans)| {
+            spans
+                .iter()
+                .map(move |&(start, end)| ((0, start, end), Target::Global(id(*n))))
+        })
+        .collect();
+    assert_eq!(plan.edits(), &expected);
+    let names: BTreeMap<_, _> = replacements
+        .iter()
+        .enumerate()
+        .map(|(i, &name)| (Target::Global(id(i + 1)), name))
+        .collect();
+    assert_eq!(plan.changed_names(), &names);
+    assert_eq!(plan.output_bytes().unwrap(), 2145);
+    assert_eq!(
+        plan.source.indexed.resolved.storage.live,
+        before.add(Slots::entries(51), Span::default()).unwrap()
+    );
+}
+
+#[test]
+fn signed_zero_scalar_bounds_defaults_and_historical_facets_preserve_original_bytes() {
+    let bundle = single(&format!(
+        r#"
+        oa_data_type a "A" id "{}" {{ definition {{ Real {{ minimum 0.0; maximum 1.0; }}; }}; default {{ Real 0.0; }}; }}
+        sa_data_type b "B" id "{}" {{ definition {{ Real {{ minimum 0.0; maximum 1.0; }}; }}; default {{ Real 0.0; }}; }}
+        trace t "T" id "{}" {{ oa @a; sa @b; kind Item; baseline {{
+            oa {{ name "A"; description ""; }}; sa {{ name "B"; description ""; }};
+            semantic {{ facets [{{ Data {{ RealMinimum {{ oa {{ Value 0.0; }}; sa {{ Value 0.0; }}; }}; }}; }}]; }};
+        }}; }}
+    "#,
+        id(2),
+        id(3),
+        id(4)
+    ));
+    let source = authored(&bundle);
+    let mut desired = source.project().clone();
+    for e in desired.elements.values_mut() {
+        let body = match &mut e.body {
+            crate::ElementBody::Oa(crate::OaBody::Shared(b))
+            | crate::ElementBody::Sa(crate::SaBody::Shared(b)) => b,
+            _ => panic!("data"),
+        };
+        let crate::SharedBody::DataType {
+            definition,
+            default,
+            ..
+        } = body
+        else {
+            panic!("data")
+        };
+        let crate::DataTypeDefinition::Real { minimum, .. } = definition else {
+            panic!("real")
+        };
+        *minimum = Some(-0.0);
+        *default = Some(crate::DataValue::Real(-0.0));
+    }
+    let facet = &mut desired
+        .traces
+        .get_mut(&id(4))
+        .unwrap()
+        .baseline
+        .as_mut()
+        .unwrap()
+        .semantic
+        .as_mut()
+        .unwrap()
+        .facets[0];
+    let crate::semantic::FacetReview::Data(crate::semantic::DataReview::RealMinimum(review)) =
+        facet
+    else {
+        panic!("historical real")
+    };
+    review.oa = crate::semantic::Observed::Value(Some(-0.0));
+    review.sa = crate::semantic::Observed::Value(Some(-0.0));
+    let plan = source.plan_rename(&desired).unwrap();
+    assert!(plan.edits().is_empty());
+    assert!(std::ptr::eq(plan.source.bundle(), &bundle));
+}
+#[test]
+fn nonzero_expression_lists_calls_and_definition_payloads_reject_changes() {
+    let bundle = single(&format!(
+        "calculation c \"C\" id \"{}\" {{ result List(Number); body [1,2]; }}",
+        id(2)
+    ));
+    let original = authored(&bundle).project().clone();
+    for bigger in [false, true] {
+        let mut desired = original.clone();
+        let a::Binding::Expression(a::Expr::List(items)) = &mut calculation(&mut desired, 2).body
+        else {
+            panic!("list")
+        };
+        if bigger {
+            items.push(a::Expr::Boolean(true));
+        } else {
+            items.pop();
+        }
+        rejected(&bundle, &desired, "non-name");
+    }
+    let bundle = rich_bundle(Layer::Oa);
+    let mut desired = rich_model(Layer::Oa);
+    let crate::ElementBody::Oa(crate::OaBody::Shared(crate::SharedBody::EngineeringProperty {
+        base: a::Binding::Expression(a::Expr::Binary { left, .. }),
+        ..
+    })) = &mut desired.elements.get_mut(&id(3)).unwrap().body
+    else {
+        panic!("property")
+    };
+    let a::Expr::Call { arguments, .. } = left.as_mut() else {
+        panic!("call")
+    };
+    arguments.remove(&a::ParameterId(id(1)));
+    rejected(&bundle, &desired, "non-name");
+    let mut desired = rich_model(Layer::Oa);
+    desired
+        .diagrams
+        .get_mut(&id(5))
+        .unwrap()
+        .nodes
+        .get_mut(&id(4))
+        .unwrap()
+        .port_anchors
+        .push(crate::PortAnchor {
+            port: id(99),
+            side: crate::PortAnchorSide::Left,
+            offset: 0.,
+        });
+    rejected(&bundle, &desired, "non-name");
+    // Opaque quantity/unit payload comparison is tested directly, independently
+    // of admission's semantic dimension rules; these are gate-level controls.
+    let mut old = rich_model(Layer::Oa);
+    old.definitions.get_mut(&id(10)).unwrap().body =
+        a::DefinitionBody::QuantityKind(a::QuantityKindDefinition {
+            dimension: crate::analysis_numeric::Dimension::ZERO,
+            algebra: a::QuantityAlgebra::Linear,
+        });
+    let mut changed = old.clone();
+    let a::DefinitionBody::QuantityKind(q) =
+        &mut changed.definitions.get_mut(&id(10)).unwrap().body
+    else {
+        unreachable!()
+    };
+    q.algebra = a::QuantityAlgebra::Affine {
+        difference: a::DefinitionRef::Local(id(11)),
+    };
+    assert!(!same_project(&old, &changed));
+    old.definitions.get_mut(&id(10)).unwrap().body = a::DefinitionBody::Unit(a::UnitDefinition {
+        kind: a::DefinitionRef::Local(id(11)),
+        scale: crate::analysis_numeric::Exact::from_integer(1),
+        offset: crate::analysis_numeric::Exact::from_integer(0),
+        symbol: "u".into(),
+    });
+    let mut changed = old.clone();
+    let a::DefinitionBody::Unit(u) = &mut changed.definitions.get_mut(&id(10)).unwrap().body else {
+        unreachable!()
+    };
+    u.symbol.push('x');
+    assert!(!same_project(&old, &changed));
+    assert!(!same_project(&old, &rich_model(Layer::Oa)));
+}
+
+#[test]
+fn same_spelling_different_callee_and_unchanged_target_corruptions_are_rejected() {
+    let bundle = rich_bundle(Layer::Oa);
+    let desired = renamed(Layer::Oa);
+    let mut plan = authored(&bundle).plan_rename(&desired).unwrap();
+    plan.edits.insert((2, 299, 300), parameter(11, 1));
+    let e = plan.validate().unwrap_err();
+    assert_eq!(e.diagnostics[0].path, "main.arcadia");
+    assert_eq!(
+        e.diagnostics[0].diagnostic.span,
+        Span {
+            start: 299,
+            end: 300
+        }
+    );
+    assert_eq!(
+        e.diagnostics[0].diagnostic.message,
+        "Rename edit set is missing a required target token."
+    );
+    let mut desired = rich_model(Layer::Oa);
+    desired.alias = "new_project".into();
+    let mut plan = authored(&bundle).plan_rename(&desired).unwrap();
+    plan.edits.insert((2, 122, 123), Target::Global(id(4)));
+    let e = plan.validate().unwrap_err();
+    assert_eq!(
+        e.diagnostics[0].diagnostic.span,
+        Span {
+            start: 122,
+            end: 123
+        }
+    );
+    assert_eq!(
+        e.diagnostics[0].diagnostic.message,
+        "Rename token targets an unchanged name."
+    );
+}
+#[test]
+fn included_file_last_reservation_preserves_its_canonical_diagnostic() {
+    let mut bundle = rich_bundle(Layer::Oa);
+    let main = bundle.files.get_mut("main.arcadia").unwrap();
+    let start = main.find("diagram d ").unwrap();
+    let end = start + main[start..].find('\n').unwrap() + 1;
+    let diagram = main[start..end].to_owned();
+    main.replace_range(start..end, "include \"z.arcadia\";\n");
+    bundle.files.insert("z.arcadia".into(), diagram);
+    let baseline = authored(&bundle).indexed.resolved.storage.live;
+    let desired = renamed(Layer::Oa);
+    // The unchanged-profile pipeline must clear every predecessor. The final
+    // ordinary header is now in the canonical last include, at d[8..9).
+    let profile = Limits {
+        entries: baseline.entries + 37,
+        ..Limits::source8(language::ParseLimits::UNLIMITED)
+    };
+    let source = resolve(parse_with_profile(&bundle, ProjectLimits::default(), profile).unwrap())
+        .unwrap()
+        .index()
+        .unwrap()
+        .index_ordinary()
+        .unwrap();
+    let e = match source.plan_rename(&desired) {
+        Ok(_) => panic!("cap accepted"),
+        Err(e) => e,
+    };
+    assert_eq!(e.diagnostics[0].path, "z.arcadia");
+    assert_eq!(e.diagnostics[0].diagnostic.span, Span { start: 8, end: 9 });
+    assert_eq!(
+        e.diagnostics[0].diagnostic.message,
+        "Source8 lowering entry limit exceeded."
+    );
+}

crates/oa-core/src/language/analysis_source/syntax.rs

@@ -40,266 +40,282 @@ pub(super) fn binding(p: &mut Cursor<'_, '_>) -> Result<Binding, Error> {
     while let Some(task) = tasks.pop() {
         p.budget.active()?;
         match task {
-            Task::Expression(minimum) => {
-                let start = p.span().start;
-                if p.text() != "(" {
-                    p.budget.entry(p.span())?;
-                }
-                tasks.push(Task::Continue(minimum));
-                match p.text() {
-                    "true" | "false" => {
-                        let value = p.text() == "true";
-                        let span = p.span();
-                        p.cursor += 1;
-                        values.push(p.node(ExpressionKind::Boolean(value), span)?);
-                    }
-                    "-" => {
-                        p.open()?;
-                        p.cursor += 1;
-                        tasks.push(Task::Unary(start, UnaryOp::Negate));
-                        tasks.push(Task::Expression(7));
-                    }
-                    "(" => {
-                        p.open()?;
-                        p.cursor += 1;
-                        tasks.push(Task::Group(start));
-                        tasks.push(Task::Expression(0));
-                    }
-                    "[" => {
-                        p.open()?;
-                        p.cursor += 1;
-                        tasks.push(Task::Next(Sequence::new(SequenceKind::List, start)));
-                    }
-                    "@" => {
-                        p.cursor += 1;
-                        let reference = p.reference()?;
-                        if p.text() == "(" {
-                            p.open()?;
-                            p.cursor += 1;
-                            tasks.push(Task::Next(Sequence::new(
-                                SequenceKind::Call(reference),
-                                start,
-                            )));
-                        } else {
-                            let end = reference.span.end;
-                            values.push(
-                                p.node(ExpressionKind::Property(reference), Span { start, end })?,
-                            );
-                        }
-                    }
-                    "$" => {
-                        p.cursor += 1;
-                        let reference = p.reference()?;
-                        let end = reference.span.end;
-                        values.push(
-                            p.node(ExpressionKind::Parameter(reference), Span { start, end })?,
-                        );
-                    }
-                    "ratio" => {
-                        let (value, literal) = p.exact_literal()?;
-                        values.push(p.number(value, literal)?);
-                    }
-                    "abs" | "not" | "if" | "sum" => {
-                        let kind = match p.text() {
-                            "abs" => SequenceKind::Unary(UnaryOp::Absolute),
-                            "not" => SequenceKind::Unary(UnaryOp::Not),
-                            "if" => SequenceKind::If,
-                            _ => SequenceKind::Sum,
-                        };
-                        p.cursor += 1;
-                        p.open()?;
-                        p.take("(")?;
-                        tasks.push(Task::Next(Sequence::new(kind, start)));
-                    }
-                    "power" => {
-                        p.cursor += 1;
-                        p.open()?;
-                        p.take("(")?;
-                        tasks.push(Task::Power(start));
-                        tasks.push(Task::Expression(0));
-                    }
-                    "as_kind" => {
-                        p.cursor += 1;
-                        p.open()?;
-                        p.take("(")?;
-                        p.take("@")?;
-                        let kind = p.reference()?;
-                        p.take(",")?;
-                        tasks.push(Task::AsKind(start, kind));
-                        tasks.push(Task::Expression(0));
-                    }
-                    _ if p
-                        .tokens
-                        .get(p.cursor)
-                        .is_some_and(|token| token.class == Class::Number) =>
-                    {
-                        let (value, literal) = p.exact_literal()?;
-                        values.push(p.number(value, literal)?);
-                    }
-                    _ => return Err(error(p.span(), "Expected an analysis expression.")),
-                }
-            }
-            Task::Continue(minimum) => {
-                if let Some((op, precedence)) =
-                    operator(p.text()).filter(|(_, prec)| *prec >= minimum)
-                {
-                    let left = values.pop().expect("completed Pratt operand");
-                    if comparison(op) && ungrouped_comparison(&left) {
-                        return Err(error(p.span(), "Comparison children require parentheses."));
-                    }
-                    p.budget.entry(p.span())?;
-                    p.cursor += 1;
-                    tasks.push(Task::Continue(minimum));
-                    tasks.push(Task::Binary(left, op));
-                    tasks.push(Task::Expression(precedence + 1));
-                }
-            }
-            Task::Binary(left, op) => {
-                let right = values.pop().expect("completed right operand");
-                if comparison(op) && ungrouped_comparison(&right) {
-                    return Err(error(
-                        right.span,
-                        "Comparison children require parentheses.",
-                    ));
-                }
-                let span = Span {
-                    start: left.span.start,
-                    end: right.span.end,
-                };
-                values.push(p.node(
-                    ExpressionKind::Binary {
-                        op,
-                        left: Box::new(left),
-                        right: Box::new(right),
-                    },
-                    span,
-                )?);
-            }
-            Task::Unary(start, op) => {
-                let operand = values.pop().expect("completed unary operand");
-                let end = operand.span.end;
-                p.close();
-                values.push(p.node(
-                    ExpressionKind::Unary {
-                        op,
-                        operand: Box::new(operand),
-                    },
-                    Span { start, end },
-                )?);
-            }
-            Task::Group(start) => {
-                let end = p.take(")")?.end;
-                p.close();
-                let value = values.last_mut().expect("completed grouped expression");
-                value.grouped = true;
-                value.span = Span { start, end };
-            }
-            Task::Next(mut sequence) => {
-                let closing = if matches!(sequence.kind, SequenceKind::List) {
-                    "]"
-                } else {
-                    ")"
-                };
-                if p.text() == closing {
-                    let end = p.take(closing)?.end;
-                    p.close();
-                    values.push(p.sequence(sequence, end)?);
-                } else {
-                    let count = sequence.values.len();
-                    let maximum = match sequence.kind {
-                        SequenceKind::List => crate::analysis::MAX_LIST_LENGTH,
-                        SequenceKind::Unary(_) => 1,
-                        SequenceKind::If => 3,
-                        SequenceKind::Sum => 2,
-                        SequenceKind::Call(_) => usize::MAX,
-                    };
-                    if count >= maximum {
-                        return Err(error(
-                            p.span(),
-                            "Too many list members or constructor arguments.",
-                        ));
-                    }
-                    let key = if matches!(sequence.kind, SequenceKind::Call(_)) {
-                        p.budget.entry(p.span())?;
-                        let key = p.reference()?;
-                        if !sequence.keys.insert(key.name.clone()) {
-                            return Err(error(key.span, "Duplicate call argument name."));
-                        }
-                        p.take(":")?;
-                        Some(key)
-                    } else {
-                        None
-                    };
-                    tasks.push(Task::Collected(sequence, key));
-                    tasks.push(Task::Expression(0));
-                }
-            }
-            Task::Collected(mut sequence, key) => {
-                sequence
-                    .values
-                    .push((key, values.pop().expect("completed sequence value")));
-                let closing = if matches!(sequence.kind, SequenceKind::List) {
-                    "]"
-                } else {
-                    ")"
-                };
-                if p.text() != closing {
-                    p.take(",")?;
-                    if p.text() == closing {
-                        return Err(error(p.span(), "Trailing comma is not an expression."));
-                    }
-                }
-                tasks.push(Task::Next(sequence));
-            }
-            Task::Power(start) => {
-                let base = values.pop().expect("completed power base");
-                p.take(",")?;
-                let negative = if p.text() == "-" {
-                    p.cursor += 1;
-                    true
-                } else {
-                    false
-                };
-                let span = p.integer()?;
-                let magnitude = p.source[span.start..span.end]
-                    .parse::<u8>()
-                    .map_err(|_| error(span, "Power exponent is outside -16..16."))?;
-                if magnitude > 16 {
-                    return Err(error(span, "Power exponent is outside -16..16."));
-                }
-                let exponent = if negative {
-                    -(magnitude as i8)
-                } else {
-                    magnitude as i8
-                };
-                let end = p.take(")")?.end;
-                p.close();
-                values.push(p.node(
-                    ExpressionKind::Power {
-                        base: Box::new(base),
-                        exponent,
-                    },
-                    Span { start, end },
-                )?);
-            }
-            Task::AsKind(start, kind) => {
-                let value = values.pop().expect("completed kind assertion value");
-                let end = p.take(")")?.end;
-                p.close();
-                values.push(p.node(
-                    ExpressionKind::AsKind {
-                        kind,
-                        value: Box::new(value),
-                    },
-                    Span { start, end },
-                )?);
-            }
+            Task::Expression(minimum) => prefix(p, minimum, &mut tasks, &mut values)?,
+            task => continue_task(p, task, &mut tasks, &mut values)?,
         }
     }
     Ok(Binding::Expression(
         values.pop().expect("one complete expression"),
     ))
 }
+// Keep mutually exclusive construction temporaries out of the numeric prefix
+// call chain. Both steps borrow the driver's original iterative stacks.
+fn prefix(
+    p: &mut Cursor<'_, '_>,
+    minimum: u8,
+    tasks: &mut Vec<Task>,
+    values: &mut Vec<Expression>,
+) -> Result<(), Error> {
+    let start = p.span().start;
+    if p.text() != "(" {
+        p.budget.entry(p.span())?;
+    }
+    tasks.push(Task::Continue(minimum));
+    match p.text() {
+        "true" | "false" => {
+            let value = p.text() == "true";
+            let span = p.span();
+            p.cursor += 1;
+            values.push(p.node(ExpressionKind::Boolean(value), span)?);
+        }
+        "-" => {
+            p.open()?;
+            p.cursor += 1;
+            tasks.push(Task::Unary(start, UnaryOp::Negate));
+            tasks.push(Task::Expression(7));
+        }
+        "(" => {
+            p.open()?;
+            p.cursor += 1;
+            tasks.push(Task::Group(start));
+            tasks.push(Task::Expression(0));
+        }
+        "[" => {
+            p.open()?;
+            p.cursor += 1;
+            tasks.push(Task::Next(Sequence::new(SequenceKind::List, start)));
+        }
+        "@" => {
+            p.cursor += 1;
+            let reference = p.reference()?;
+            if p.text() == "(" {
+                p.open()?;
+                p.cursor += 1;
+                tasks.push(Task::Next(Sequence::new(
+                    SequenceKind::Call(reference),
+                    start,
+                )));
+            } else {
+                let end = reference.span.end;
+                values.push(p.node(ExpressionKind::Property(reference), Span { start, end })?);
+            }
+        }
+        "$" => {
+            p.cursor += 1;
+            let reference = p.reference()?;
+            let end = reference.span.end;
+            values.push(p.node(ExpressionKind::Parameter(reference), Span { start, end })?);
+        }
+        "ratio" => {
+            let (value, literal) = p.exact_literal()?;
+            values.push(p.number(value, literal)?);
+        }
+        "abs" | "not" | "if" | "sum" => {
+            let kind = match p.text() {
+                "abs" => SequenceKind::Unary(UnaryOp::Absolute),
+                "not" => SequenceKind::Unary(UnaryOp::Not),
+                "if" => SequenceKind::If,
+                _ => SequenceKind::Sum,
+            };
+            p.cursor += 1;
+            p.open()?;
+            p.take("(")?;
+            tasks.push(Task::Next(Sequence::new(kind, start)));
+        }
+        "power" => {
+            p.cursor += 1;
+            p.open()?;
+            p.take("(")?;
+            tasks.push(Task::Power(start));
+            tasks.push(Task::Expression(0));
+        }
+        "as_kind" => {
+            p.cursor += 1;
+            p.open()?;
+            p.take("(")?;
+            p.take("@")?;
+            let kind = p.reference()?;
+            p.take(",")?;
+            tasks.push(Task::AsKind(start, kind));
+            tasks.push(Task::Expression(0));
+        }
+        _ if p
+            .tokens
+            .get(p.cursor)
+            .is_some_and(|token| token.class == Class::Number) =>
+        {
+            let (value, literal) = p.exact_literal()?;
+            values.push(p.number(value, literal)?);
+        }
+        _ => return Err(error(p.span(), "Expected an analysis expression.")),
+    }
+    Ok(())
+}
+fn continue_task(
+    p: &mut Cursor<'_, '_>,
+    task: Task,
+    tasks: &mut Vec<Task>,
+    values: &mut Vec<Expression>,
+) -> Result<(), Error> {
+    match task {
+        Task::Expression(_) => unreachable!("prefix tasks are dispatched by the driver"),
+        Task::Continue(minimum) => {
+            if let Some((op, precedence)) = operator(p.text()).filter(|(_, prec)| *prec >= minimum)
+            {
+                let left = values.pop().expect("completed Pratt operand");
+                if comparison(op) && ungrouped_comparison(&left) {
+                    return Err(error(p.span(), "Comparison children require parentheses."));
+                }
+                p.budget.entry(p.span())?;
+                p.cursor += 1;
+                tasks.push(Task::Continue(minimum));
+                tasks.push(Task::Binary(left, op));
+                tasks.push(Task::Expression(precedence + 1));
+            }
+        }
+        Task::Binary(left, op) => {
+            let right = values.pop().expect("completed right operand");
+            if comparison(op) && ungrouped_comparison(&right) {
+                return Err(error(
+                    right.span,
+                    "Comparison children require parentheses.",
+                ));
+            }
+            let span = Span {
+                start: left.span.start,
+                end: right.span.end,
+            };
+            values.push(p.node(
+                ExpressionKind::Binary {
+                    op,
+                    left: Box::new(left),
+                    right: Box::new(right),
+                },
+                span,
+            )?);
+        }
+        Task::Unary(start, op) => {
+            let operand = values.pop().expect("completed unary operand");
+            let end = operand.span.end;
+            p.close();
+            values.push(p.node(
+                ExpressionKind::Unary {
+                    op,
+                    operand: Box::new(operand),
+                },
+                Span { start, end },
+            )?);
+        }
+        Task::Group(start) => {
+            let end = p.take(")")?.end;
+            p.close();
+            let value = values.last_mut().expect("completed grouped expression");
+            value.grouped = true;
+            value.span = Span { start, end };
+        }
+        Task::Next(mut sequence) => {
+            let closing = if matches!(sequence.kind, SequenceKind::List) {
+                "]"
+            } else {
+                ")"
+            };
+            if p.text() == closing {
+                let end = p.take(closing)?.end;
+                p.close();
+                values.push(p.sequence(sequence, end)?);
+            } else {
+                let count = sequence.values.len();
+                let maximum = match sequence.kind {
+                    SequenceKind::List => crate::analysis::MAX_LIST_LENGTH,
+                    SequenceKind::Unary(_) => 1,
+                    SequenceKind::If => 3,
+                    SequenceKind::Sum => 2,
+                    SequenceKind::Call(_) => usize::MAX,
+                };
+                if count >= maximum {
+                    return Err(error(
+                        p.span(),
+                        "Too many list members or constructor arguments.",
+                    ));
+                }
+                let key = if matches!(sequence.kind, SequenceKind::Call(_)) {
+                    p.budget.entry(p.span())?;
+                    let key = p.reference()?;
+                    if !sequence.keys.insert(key.name.clone()) {
+                        return Err(error(key.span, "Duplicate call argument name."));
+                    }
+                    p.take(":")?;
+                    Some(key)
+                } else {
+                    None
+                };
+                tasks.push(Task::Collected(sequence, key));
+                tasks.push(Task::Expression(0));
+            }
+        }
+        Task::Collected(mut sequence, key) => {
+            sequence
+                .values
+                .push((key, values.pop().expect("completed sequence value")));
+            let closing = if matches!(sequence.kind, SequenceKind::List) {
+                "]"
+            } else {
+                ")"
+            };
+            if p.text() != closing {
+                p.take(",")?;
+                if p.text() == closing {
+                    return Err(error(p.span(), "Trailing comma is not an expression."));
+                }
+            }
+            tasks.push(Task::Next(sequence));
+        }
+        Task::Power(start) => {
+            let base = values.pop().expect("completed power base");
+            p.take(",")?;
+            let negative = if p.text() == "-" {
+                p.cursor += 1;
+                true
+            } else {
+                false
+            };
+            let span = p.integer()?;
+            let magnitude = p.source[span.start..span.end]
+                .parse::<u8>()
+                .map_err(|_| error(span, "Power exponent is outside -16..16."))?;
+            if magnitude > 16 {
+                return Err(error(span, "Power exponent is outside -16..16."));
+            }
+            let exponent = if negative {
+                -(magnitude as i8)
+            } else {
+                magnitude as i8
+            };
+            let end = p.take(")")?.end;
+            p.close();
+            values.push(p.node(
+                ExpressionKind::Power {
+                    base: Box::new(base),
+                    exponent,
+                },
+                Span { start, end },
+            )?);
+        }
+        Task::AsKind(start, kind) => {
+            let value = values.pop().expect("completed kind assertion value");
+            let end = p.take(")")?.end;
+            p.close();
+            values.push(p.node(
+                ExpressionKind::AsKind {
+                    kind,
+                    value: Box::new(value),
+                },
+                Span { start, end },
+            )?);
+        }
+    }
+    Ok(())
+}
 impl Sequence {
     fn new(kind: SequenceKind, start: usize) -> Self {
         Self {

harness/analysis-carried-phase-implementation-20260925.md

@@ -0,0 +1,31 @@
+# Private carried-baseline phase-check implementation
+
+2026-09-25. Based on `18073a6f2eabce83fc83997f094e331eec835a16`; implements the limited prerequisite selected in `harness/analysis-carried-phase-contract-20260925.md` (parent evidence commit `a2c781773454ee932a9e292e6dc93f551f9f86c5`). Source and tests are authored; compilation/runtime acceptance belong to parent gates and are not claimed here.
+
+`mixed/carried.rs` introduces an opaque non-Clone input backed by either a fixed borrowed bundle with captured policy or a borrowed allocation-owning RetainedSnapshot. Every new constructor is `cfg(test)`. The retained fixture owns the actual complete SourceBundle and computes exactly F map slots, zero lower occurrence slots and all source/key/entry UTF-8 bytes. The parser cannot substitute a different bundle at invocation. There is no production emitter/old-owner transition, accepted-output result, public source8 activation or editing authority.
+
+The shared parser implementation has explicit legacy versus carried mode. Existing entry functions choose legacy and preserve their separate metadata checkpoints. Carried mode checks C initially, C+file metadata before traversal, C+U+M before every position projection and at complete syntax return, even when C is zero. Checks use existing logical Slots arithmetic and inherited ceilings; they are not additional retained reservations. A narrow read-only Budget policy getter preserves all Limits values. Every snapshot still has one fresh Budget and normal independent Usage/Exact work, with exact caller ProjectLimits.
+
+ParsedMixedSyntax retains the guard. Consumed resolution seeds its Ledger from that guard once, then runs the existing syntax accounting and subsequent reservation/release sequence unchanged. Successful ownership naturally retains the guard through syntax inside resolved/indexed owners. A cfg(test) immutable `phase_state` observer exposes syntax/Slots for sibling tests; it exposes no mutation or production constructor.
+
+Temporal scope is deliberately limited: current-unit parsing and syntax string decoding/copying can precede aggregate phase refusal, and retained syntax text is counted during resolution. Existing grammar event checks remain before their declared allocations; this prerequisite does not add universal parser allocation admission. Model/serde/raw validator heap, allocator capacity/RSS and stack frames keep their established exclusions. Stronger before-growth obligations, output creation, whole actual-output equality and accepted edited-output ownership remain future requirements. This work neither closes nor waives them.
+
+Twelve authored tests cover independent E/H bundle counts and whole Project oracles, real retained guard identity, exact new Usage, once-only resolver +C retention, parser 13/12 and 25/24 boundaries, resolver 17/16 and 29/28 entry peaks, 112/111 and 214/213 text peaks, canonical original diagnostic paths/spans, initial C/file checks, postdecode syntax text and ordinary position-key copy accounting, unchanged legacy versus explicit carried-zero timing, all captured Limits/ProjectLimits fields, real byte/token/reference/frame/Exact/model/file/depth/include policies, and OA/SA Unicode/CRLF compatibility through both index families. Nonzero occurrence and impossible arithmetic cases are explicitly labeled fault injection; the actual retained bundle owner has no occurrence storage.
+
+E is 78 source bytes with C=(1,0,102), U 1 / M 11 and final (13,0,110). H is 132 source bytes with C=(3,0,180), U 3 / M 19 and final (25,0,212); its final comment contains actual é and is 6 UTF-8 bytes. These expectations come from the independent parent oracle, not application outputs. Syntax-only exact caps are not reported as full-resolve successes. Parser default resource spans remain 0..1; resolver restores 0..0 or the original header/include extent.
+
+Zero carried mode intentionally refuses E cap 11 at preprojection, while legacy cap 11 still produces syntax and then refuses resolution at U+M 12. This distinction preserves the old API timing without numerically bypassing the new carried contract. Borrowed policy capture from a still-live fixture witness is test-only propagation evidence, not proof old auxiliary B was consumed or dropped.
+
+No Cargo/build/test execution was performed by the implementation agent. Targeted rustfmt on owned files and raw-LF normalization are authoring checks only. Parent owns source review integration, exact-source commits, compiler/focused/full-suite gates and publication. Inherited full-suite failures and formatting issues are not addressed by this patch; parent gates will compare actual outcomes. The documented environment-sensitive upstream stack observation remains a limitation. Existing small-stack controls were not edited or waived.
+
+Independent test-source review corrected two pre-execution fixture mistakes: use the accepted oa_property/sa_property keywords, and distinguish the parser include-edge error span 0..1 from the traversal include-depth span 0..23. These are source-review corrections, not recorded runtime failures.
+
+## Recorded regression and slim-guard candidate
+
+Parent's `d11b99bb` focused run passed all 12 carried tests, but its full run aborted at the unchanged `ordinary_index::tests::small_stack_success_and_late_header_failure_leave_no_partial_owner` with STATUS_STACK_OVERFLOW. The predecessor `18073a6f` full run had completed with 230 passing tests and 16 inherited failures, including that control. This is a failed current full gate, not an inherited-failure waiver or an accepted repair.
+
+The exact-artifact LLDB trace reproduces the overflow during Windows heap allocation under formatting/Exact::parse_decimal, then exact_literal, syntax::binding, declarations::parse, State::parse_typed, Parser::unit, new parse_impl, parse_with_profile, parse, accepted/indexed helpers and the existing worker. The diagnostic child's killed exit is not a test pass. Parent measured individual prologues of parse_impl 11,144 bytes, parse_with_profile 312, accepted 1,752, indexed 1,704 and worker 7,752; these are not the complete active stack. Raw evidence remains in the parent gate records, including `carried-debugger-d11b99b-1.log` and `carried-full-d11b99b-1.stack-frames.json`.
+
+The selected narrow candidate consumes CarriedInput before entering the shared parser. Exact captured policy transfers into Budget and syntax.limits; the retained CarriedGuard holds only Borrowed or Retained(&RetainedSnapshot). This removes the duplicate inline SnapshotPolicy payload from parsed/resolved/indexed/result carriers, while retained backing still borrows the actual allocation-owning bundle. Borrowed source identity remains bound through ParsedMixedSyntax.bundle. Explicit Some mode still distinguishes carried zero from legacy None, and all checks/reservations/Usage remain unchanged. No heap allocation or new logical storage was introduced. The parser wrapper remains uninlined and unchanged.
+
+Only carried tests' guard-shape inspection and direct injected-arithmetic access follow the new internal guard type; all expected counts, limits, spans, outcomes and existing stack tests remain unchanged. The candidate is not claimed to establish a sole overflow cause or a successful repair before parent exact-source gates. All original failure evidence remains retained.

harness/analysis-mixed-emission-implementation-20260925.md

@@ -0,0 +1,23 @@
+# Private mixed emitted-unverified transition
+
+2026-09-25. Implementation candidate from `fa7a980418ef99d772e67c66c28dfa7b5181f875`, under the accepted root contract `harness/analysis-mixed-emission-contract-20260925.md` published at `6c0d9e80`. This note reports source work; parent owns compilation and runtime acceptance.
+
+`RenamePlan::into_unchanged` and `emit_changed_unverified` consume the plan. Both recheck the entire current bundle and reuse the complete original-coordinate edit validator; wrong-branch calls refuse. Unchanged returns the original admitted owner. Changed refuses every explicit carried guard, including zero-baseline mode, because dropping that guard cannot release its externally owned retained allocation.
+
+Changed emission computes O as one entry per output file and text equal to all final source bytes plus all owned keys plus entry bytes. It reserves O once against the existing live plan ledger B (which already contains R and M) before output copies. Each canonical file has one final String; scalar sizing walks borrow existing maps. Original-coordinate slices and replacement names are appended without parsing, decoding, normalization or sequential textual substitution. Length and complete-file checks precede the transition. The old names map, edits map and entire source witness explicitly drop before the opaque PendingRename is created. Caller-owned original source and desired Project remain external. Pending owns the bundle, exact policies, O, original expression count E and desired borrow; it has no extraction, parser/adoption or accepted-result API. E is provenance, not a proven equality bound on arbitrary future faulty output.
+
+The split API avoids a common large enum, callback framework, heap indirection or lint suppression. No producer hooks, carried constructor, semantic verification, public source8 dispatch, persistence or history behavior changed. Original stack controls and inherited failure/formatting dispositions are not edited or claimed repaired.
+
+## Source checks and authored tests
+
+Independent source reviewer inspected production before tests completed. Direct targeted rustfmt only; no Cargo, executable tests or compiler run by the implementer. Eleven new tests are selected by `emission`: ten in the new emission child and one appended to carried tests.
+
+- Actual predecessor-compatible E entry/text caps 17/114 versus 16/114 and 17/113, and H caps 29/216 versus 28/216 and 29/215; expected pending O values (1,0,105) and (3,0,183), complete literal bytes and source/entry/key ownership.
+- No-op identity, usage, numeric work, warnings and retained ledger below copy-overlap byte ceilings; desired lifetime ends while unchanged owner survives.
+- Both wrong branches, touched/untouched stale bytes, entry/path/file-set changes, equal independently owned current input, and selected reused edit-validator failures. Checked-add overflow is labeled arithmetic fault injection.
+- All exact Limits/ProjectLimits fields and a pending result escaping the original source-bundle scope.
+- Rich OA/SA global/scoped swaps with repeated/reordered labels, independently authored whole files in LF and Unicode/CRLF variants; four-file cross-family swap with an untouched comment file; full ordinary category output preserving prose, commented references and historical UUID; combined growth/shrinkage with an unchanged file.
+- Actual retained and borrowed-zero carried sources: changed refuses; no-op preserves the original guard through a subsequent changed refusal.
+- Scoped 128 KiB worker success/no-op/refusal and local drops, with parser prerequisites constructed normally. The same test also moves complete deep 128-node and wide 129-node owners into workers for changed emission and unchanged extraction/drop, asserting E and whole output bytes; the isolated storage refusal uses the minimal fixture. Existing full-pipeline stack tests remain unchanged.
+
+Oracle source: independent emission and rename-plan reports published with the contract/evidence, not output obtained from this emitter. Pre-execution review corrected a policy fixture that exceeded its caller byte/reference ceiling. Raw-byte inspection corrected the category expected literal to preserve its two specific CRLF line endings among LF lines rather than converting the whole file. These were authoring corrections, not runtime failures. Parent gates must still establish compile, actual boundary behavior, whole bytes, unchanged full-suite dispositions, Clippy and formatting.

harness/analysis-mixed-parser-stack-repair-20260925.md

@@ -0,0 +1,13 @@
+# Private Pratt parser stack-frame repair candidate
+
+2026-09-25. Separate correction after emission source `19a4082117b88caf332198e4c685bde91005cb52`. Parent recorded eleven focused emission tests passing, then a full-suite STATUS_STACK_OVERFLOW (0xc00000fd) in the unchanged ordinary-index 128 KiB control. The prior `fa7a9804` full run completed. This note preserves the failed candidate rather than treating focused success as acceptance.
+
+Parent's exact 19a4082 artifact is 42,402,816 bytes, SHA256 `777457cfefb8a3046e3f0809cabd936cfb742abe792befad2c50e05dfac1bf6b`. Its LLDB trace reproduces overflow in Windows allocation beneath formatting in Exact::parse_decimal, then exact_literal, syntax::binding, declarations::parse, State::parse_typed, Parser::unit and parse_impl. No emitter call is active. A debugger process killed with exit 0 is not a test pass. Raw parent records live in `.local/analysis-mixed-emission-gates-20260925/emission-full-19a4082-1.*` and `emission-debugger-19a4082-1.*`; integration owns publication.
+
+Parent measured fixed active prologues: binding 27,272 B, declarations::parse 22,664 B, Parser::unit 11,864 B, State::parse_typed 6,952 B. The previously measured outer frames (parse_impl 11,048 B, profile wrapper 200 B, parse 280 B, accepted 1,432 B, indexed 1,496 B, worker 6,920 B) match fa7. These partial native reservations are not total stack use. No inherited owner field or parser source changed in emission, so duplicated inline policy is not the cause established here. Environment-sensitive headroom remains a limitation; the failed full run still blocks acceptance.
+
+## Narrow correction
+
+`syntax.rs` keeps the same iterative binding driver, task/value Vec allocations, initial active check/unbound branch, per-popped-task active check, and final value extraction. The current Task::Expression body moves mechanically to a private prefix step borrowing those Vecs and Cursor. Remaining task arms move mechanically to a continuation step, also borrowing the same containers. No recursive parser call, new collection, clone, Box/Arc, numeric parsing change, work debit, depth limit, logical reservation or producer-timing claim is introduced. All cursor mutations, pushes/pops, opening/closing, validation, spans and error order remain at the same points. Steps return unit or the same Error; the driver retains ownership and cleanup of its original stacks.
+
+The intended native-stack improvement is that numeric prefix work no longer runs below all continuation construction temporaries in one large function. This is a source-level rationale, not an accepted measurement. Parent must measure the new active driver+prefix prologue sum against 27,272 B (and driver+continuation where relevant), then run unchanged stack controls and required focused/full gates. No test, fixture, allowance, RUST_MIN_STACK, Exact implementation or forwarding wrapper was changed. Independent source review checks all moved arms; targeted rustfmt and diff checks are the only implementer tools, with no compiler/runtime execution.

harness/analysis-mixed-rename-plan-implementation-20260924.md

@@ -0,0 +1,33 @@
+# Private complete-target mixed rename planning
+
+2026-09-24. Descendant implementation of base `ee500908e3d77182ddd54e12524f9b6c6eb43b60`, under accepted parent contract `dc87babf` (`harness/analysis-mixed-rename-plan-contract-20260924.md` on the evidence branch). This note describes source and authored tests, not completed runtime acceptance.
+
+`AuthoredMixedProject::plan_rename` consumes the complete admitted source witness and borrows an immutable whole desired Project. `RenamePlan` retains that witness, desired borrow, changed qualified names and one original-coordinate physical edit map. Read-only methods expose source, desired, names, edits, full-current-bundle validation and combined complete output-byte sizing. There is no emitter, rewritten-output admission, public activation or legacy adapter.
+
+The whole-target gate uses exhaustive record patterns, collection keys/counts and parameter position/identity/type checks. Existing PartialEq semantics govern all unchanged payloads, including signed floating zero. Its expression work vectors run under an E-entry reservation, where E is the retained raw expression-site count. Current expression roots are calculation bindings, engineering-property base, case overrides and check predicates; historical semantic fields have no analysis Expr. E scratch is released before changed names are collected; the final namespace set is dropped before edits are collected. Successful retained growth is R+M entries, zero occurrence slots and zero copied text. Parsing, numeric and frame Usage remain unchanged.
+
+Both authenticated occurrence families feed one map. Validation checks original token spelling/UTF-8 authority, whole Word spans, physical nonoverlap and exact required key/qualified-target membership. Bundle validation includes entry, every path/file and untouched bytes. Sizing subtracts the sum of removed bytes before adding replacements per file, then includes all files in the inherited byte check. Emission/re-admission lifecycle and aggregate output storage remain required successors.
+
+Independent source review found and prompted two pre-compiler repairs: preserve canonical file attribution for edit-reservation failures, and check ordered parameter shape before calculation-body equality. No runtime failure claim is attached to these source findings. Existing historical mixed/ordinary failures and prior baseline results remain unchanged; this work does not overwrite their records.
+
+The 17 authored tests cover independently specified complete rich OA/SA and Unicode/CRLF maps and final-name sets; all36 category edits including real comment-separated references and historical UUID exclusion; identity/map/parameter/non-name field rejections; QuantityKind/Unit payload gate controls; simultaneous global/scoped swaps and collisions; immutable exact target/source borrowing; no-op; unchanged Usage and R+M retention; stale touched/untouched/path/entry/file-set controls; safe corrupted UTF-8/file authority and same-spelling wrong-callee identity; signed-zero geometry, scalar bounds/defaults and historical real facets; deep/wide old equality and target-only trees with small-stack success/drop and late refusal.
+
+Storage oracle: rich OA B=resolved+65, E15/Q11/R11/M27; added peak38 and retention38. Inherited B+37/B+38 tests run the entire predecessor pipeline before planning, and the negative checks the last ordinary diagram header main[412..413). A separate diagram moved to canonical last include z.arcadia checks precise included-file allocation diagnostics, contingent on its complete predecessor pipeline fitting the unchanged profile. No test replaces/tightens a live owner's Budget to manufacture a later-phase failure. Wide/deep equality tests assert authored E128/E129; no unsupported isolated E-cap claim is made.
+
+Combined-size oracle uses original930 bytes: ordinary31-byte node alias shrinks to1 while three typed f aliases grow to9; complete924 fits although typed-only intermediate954 would not. A12-byte replacement produces933 and must fail under the same inherited930-byte cap, including the untouched213-byte file. This tests planned sizing only, never output correctness.
+
+All source/tests require parent compilation, focused runtime tests and existing broader gates. Direct rustfmt is the only executed Rust tool during authoring. Parent owns commit/publication and verification evidence; no Cargo/build/test execution was performed by this implementation agent.
+
+## Recorded first runtime failure and narrow test repair
+
+Parent's `9388fcf2` focused run compiled and passed four tests before the 128 KiB deep/wide worker terminated with Windows stack-overflow exit 0xc00000fd. Parent separately ran the remaining 16 tests from that exact original artifact: all passed, explicitly excluding the crashing test. This is not a 17-test acceptance result.
+
+Diagnostic source `9e8e77e1` established that deep admission, whole original clone, rename success and successful plan drop completed; failure followed entry into the collision-rejection helper. Diagnostic source `8159a17d` further located the overflow inside that helper's `authored(bundle)` call: its flushed before-admission marker appeared, but its after-admission/before-plan marker did not. Thus that failing helper invocation had not entered rename planning. These observations do not prove a particular compiler frame size or establish model cloning as the cause.
+
+The bounded repair removes diagnostic markers and restores the general helper. Only this small-stack test directly creates each fresh owner at worker scope and matches each planning result there. It still uses 128 KiB, deep 128 and wide 129 expression nodes, complete admission on the worker, success/plan-drop, late final-namespace collision/refusal-drop and non-name semantic refusal/drop for both shapes. Prior plan, diagnostic and desired owners are explicitly dropped before subsequent cases. No fixture depth/width or stack allowance is weakened; no production code changes. The repaired full 17-test focused run and broader gates remain parent-owned and pending.
+
+The direct-call candidate at `70c20c3` also aborted the small-stack test after the same first four focused tests passed. That candidate is **not** an accepted repair. The next test-only candidate uses a compact mode loop: each shape runs no-op success, final-namespace collision and non-name refusal through one shared source local, one desired clone and one planning result expression, with explicit plan/failure/desired drops. Complete admission remains inside the 128 KiB worker for every case; depths and expected outcomes are unchanged. This removes repeated case-specific large debug temporaries as a bounded layout experiment; no exact compiler frame size or overflow cause is claimed. If it still fails, actual-frame diagnostics are required before further rearrangement. Parent-focused verification remains pending.
+
+Parent's `f1c0956` debugger evidence supersedes the unlocated layout hypothesis: run3 backtrace reaches `mixed::parse_with_profile -> Parser::unit -> parse_typed -> declarations::parse -> syntax::binding -> Cursor::exact_literal -> Budget::exact -> Exact::parse_decimal -> BigInt::parse_bytes -> Windows heap allocation`, before any rename-plan call. The same artifact's debugger run2 passed, so the full admission-on-128-KiB observation remains an **UNRESOLVED environment-sensitive stack boundary**, not a demonstrated planner defect or a repaired production issue. Raw evidence is the parent-owned `rename-debugger-f1c0956-3.log` and receipt; all preceding failed full-pipeline observations remain valid and preserved.
+
+The final narrowly scoped planner evaluator prepares each fresh complete admitted owner and immutable desired Project on the normal test thread. For all six deep128/wide129 × no-op/collision/non-name cases, a scoped128-KiB worker moves the complete owner, borrows desired, invokes planning, checks the exact expected outcome, and drops its successful plan or failure there. No owner/result escapes, policy resets or leaks occur. Desired is externally owned and destroyed outside the worker. Depth, width, worker stack allowance and all planning/drop cases are unchanged. This test now claims only planner comparison/ownership/drop behavior; it makes **no claim** that the complete upstream parse/admission pipeline reliably fits128KiB under every observed environment. Existing separate admission/index small-stack tests remain in the parent full-suite gates. Final focused/full runtime acceptance is still parent-owned and pending.