# Private actual-output rename acceptance

Base `29417130c71f70c4eaefe8ed4c879efba78eb72c`. Implements the parent-selected
`harness/analysis-mixed-acceptance-contract-20260925.md` (root b86c8dbc) within the
private experimental mixed source path. No public source8, save, history,
installation or repeated carried-source emission is enabled.

A consumed PendingRename now verifies its actual complete bundle through the
combined text/entry producer parser and existing complete resolver/admission.
CarriedInput and its slim guard borrow that entire pending owner; covariance
shortens the desired borrow to the verification scope without another parser
lifetime, policy copy in guards, arbitrary tuple constructor or heap wrapper.
Narrow immutable views supply the exact bundle, policy and retained O together.
The existing fixture constructors and old parser modes remain available unchanged.

The actual resolved expression arena supplies E for equality reservation against
its full live storage. Complete actual Project PartialEq compares every field
with desired; old name-exempt equality and pending's original E are not used.
A static entry/default-span diagnostic reports mismatch. Warning inventory uses
an exhaustive borrowed diagnostic-field match, checks empty related/non-Error
shapes and sums checked entries/text. O+W is checked as a componentwise live
subset and against inherited ceilings without resetting or double-charging the
full ledger. Actual model/warnings move after equality; expression/occurrence
arenas, syntax and complete pending guard drop before the bundle moves into
AcceptedRename. Its private fields have read-only accessors, exact policies,
final retained slots and separate verification Usage/numeric work; no input or
desired borrow remains.

Eleven new tests use the acceptance module filter. Independent minimal literal
and whole model verify 152/151 through one unchanged profile; warning literals
and full diagnostics verify 161/160 and final O+W=(2,0,157). Exact policy fields
and a lexical scope dropping all inputs exercise returned ownership. Previously
authored OA/SA/scoped-global swap and UTF-8/CRLF/all-file literals are reused,
including an untouched fourth file. Equal-byte wrong alias/name, malformed
source and parseable containment-cycle corruption separate equality, syntax and
model-admission refusal. Actual E1->3 corruption plus a labeled internal ledger
fault distinguishes reserving3 from trusting old1, without a fabricated late
end-to-end equality cap. Other internal controls cover warning shapes, final
subset and checked inventory overflow.

Scoped 128 KiB workers perform actual verification/assertions/drop for deep128
and wide129 expression nodes (success and target-only mismatch), plus the genuine
151-byte late refusal. All original prerequisites are prepared outside those
workers. Separate E0 target-only deep/wide and signed-zero geometry/scalar/history
cases exercise complete equality. Positive-zero bits in actual returned model
help distinguish moving the parsed model from substituting desired intent.

Before execution, source review prompted correcting the carried module summary;
parent readback caught an unnamed-source test slice, replaced with the exact
independent 71-byte original literal. Local type inspection corrected the f32
geometry bit assertion. These are pre-execution authoring corrections, not
runtime failures. No prior tests or stack sizes are edited. Only touched Rust
files were directly formatted with skip_children; compiler, full prior outcome
comparison, Clippy, format and measured prologue/stack gates belong to the parent.
No runtime result was claimed at that initial handoff; see the correction below.

The selected retained/decode/equality domain remains logical, not universal heap
or before-every-allocation accounting. Existing traversal/path-copy, delimiter,
ordinary-open, Pratt and duplicate-name scratch keep their independent controls
and stated exclusions; model/validator/numeric/decoder internals and native stack
remain separate domains. File counts do not tightly bound traversal path bytes.
Actual lifetime coercion and stack headroom still require the parent gates.

## Initial focused failure and test-oracle correction

Parent's initial focused run of `4872141c036c16825f1c098bd7cf44709897e814`
compiled successfully and completed 9 passes / 2 failures. The failing assertions
incorrectly required empty warnings in the rich OA/SA and four-file fixtures.
The original run, log and artifact remain preserved under the parent's
`analysis-output-acceptance-gates-20260925/acceptance-focused-4872141-1` records;
artifact cba18de5 prefix, 43,060,224 bytes. Those failures are not erased or called
production failures. The other nine controls, including both late byte caps and
scoped 128 KiB verification/drop, passed in that run.

Source-derived correction: validation.rs emits unallocated_leaf first, with
field allocation and message "Allocate leaf 'Work' to a performer."; its later
coverage.validate call emits work_without_behavior_context, field None, message
"Include this leaf activity/function in a process/chain or scenario through a
work action or exchange occurrence." Both are Warning, object ID2, empty related,
and map to the full Work declaration. The first local derivation missed the
coverage advisory; independent review caught it before the correction commit.
The pre-existing project expected_leaf_work_warnings oracle confirms both/order.

New tests now require both complete mapped diagnostics, with independent literal
spans: rich OA/SA main338..403 line6 column1, or Unicode/CRLF351..416 line7 column1;
four-file b.arcadia25..90 line2 column1. Warning storage is (2,0,227) for main,
(2,0,221) for b.arcadia. Final rich entries5/text1169,1212,1243,1286 for OA LF,
OA transformed, SA LF, SA transformed; four-file entries6/text747. Production
acceptance and all original test bodies remain unchanged. This is a test-only
oracle repair plus this note; corrected runtime acceptance awaits parent gates.