# Independent actual-output acceptance oracle — proposal only

Source inspected: `a629ae01d49bb3cb482a047eb41832ad4246a5c6`. Derived from literal
bytes and existing source, not parser/emitter execution. Only string lengths and
literal substring offsets were evaluated. Future verification API/domain/equality
contract is not yet selected; all runtime acceptance remains pending.

## Minimal real rename, one unchanged inherited policy

Entry/key `main.arcadia` has 12 ASCII bytes. Original exact source (final LF):

```text
arcadia 8;
project p "Project" id "00000000-0000-0000-0000-000000000001" {

}
```

Desired differs only in project alias `p` -> `next`. Expected complete emitted
bundle is exactly one file under the same entry/key, containing (final LF):

```text
arcadia 8;
project next "Project" id "00000000-0000-0000-0000-000000000001" {

}
```

Original source is 78 bytes; output is 81. The sole edit is original [19,20),
replacement `next` (four bytes); output alias is [19,23), display text [25,32),
UUID quoted token [37,75). Output retained O=(1 entry, 0 occurrences, 105 text),
where 105=81 source+12 map key+12 entry bytes. No output key/path is omitted.

Complete expected Project: schema_version=8; id=00000000-0000-0000-0000-000000000001;
alias="next"; name="Project"; description=""; definitions, elements, relations,
diagrams, artifact_links and traces are all empty maps. Expected warnings empty.
This asserts every model field, not just the changed alias. E_original=E_actual=0.

Select original Limits entries=17, bytes=152 (or 151 negative), all other fields
unchanged from an admissible roomy source8 profile; keep the same ProjectLimits
through original parse/index/plan/emission/verification. Never tighten live policy.

| Stage | Logical entries | Logical text | Derivation |
| --- | ---: | ---: | --- |
| Original syntax retained |12|8|U1 + M11; alias1+name7 |
| Original resolver peak |16|10|Project catalog +4 entries, two alias copies |
| Original typed index retained |13|9|One global name; no typed headers/expressions |
| Original ordinary index retained |14|9|One authored project header |
| Rename plan peak/retained |16|9|R1 name target + namespace Q1 (then dropped), M1 edit |
| Emission overlap |17|114|Plan16/9 + output O1/105 |
| Output strong syntax retained |13|116|C1 + U1 + M11; C105 + T11 |
| Output resolver peak |17|124|Syntax13 + project catalog4; two four-byte alias copies |
| Output resolved retained/equality |13|116|Catalog dropped; E_actual0 equality scratch |
| Owning accepted bundle after verification owners drop |1|105|Only actual output O remains |

Original indexing/transient peaks do not exceed the original resolver/plan/emission
entry ceiling17 for this empty model; prior emitted-overlap source tests explicitly
use entries17 and bytes114 through the real predecessor path. The new proposed
152/151 byte profiles are looser than that already authored predecessor boundary.
No new verification allocation occurs while the old authored owner remains live.

## Exact new byte boundary and timing

Scanner validation of the output UUID reserves raw payload36 before decoding.
No grammar text exists during that file scan: C105+W36=141 (display payload7 is
smaller). Grammar first retains alias4 and display name7, hence T11. Its UUID
consumer reserves P36 while T11 remains live: 105+11+36=152, before the existing
serde decode. Valid decode D36 transfers then UUID parsing drops/refunds it;
final T11 and W0. Project has no projected ordinary values or textual keys.

Therefore 152 is the full-pipeline positive byte cap and 151 isolates the new
actual-output grammar producer refusal, after predecessors/emission and scanner
have fit. Expected source path main.arcadia, code invalid_source, message
`Source8 index/output byte limit exceeded.`, ordinary transported span [37,38),
line2 column27, no related locations. Raw quoted extent is [37,75), but the
ordinary error transport intentionally retains its one-byte start representation.
Do not expect this refusal at the former unverified-emission114 boundary.

Entry cap17 permits the whole pipeline, but cap16 refuses **emission first**:
plan16 plus O1 cannot fit. Thus it cannot demonstrate a later verification/resolver
entry refusal. Equality reserves zero here; no equality-specific minus-one case
exists. A different justified fixture is needed for any proposed late entry gate.

## Equal-byte corruption controls (not genuine emitted results)

Start each control from a fresh legitimately emitted pending owner under roomy
unchanged inherited limits. Mutate only in the private fixture harness. Equal UTF-8
length preserves O numerically; production must not expose mutation/constructors.

- Output alias [19,23): `next` -> `nope`. Valid alias and otherwise empty model;
  parse/admission should pass, complete Project equality must reject.
- Output name [25,32): `Project` -> `Changed`. Valid decoded display name, same
  seven bytes; parse/admission should pass, non-name equality must reject.
- Version byte [8,9): `8` -> `?`. Equal bytes, malformed source; scanner/parser
  must reject before model equality. Do not claim a successful wrong-model case.

Each failure must drop pending verification state, return no accepted owner, and
leave original source and desired unchanged. Do not recursively format models.
The new verifier's semantic-mismatch message is deliberately unspecified here.

## Actual expression count larger than original, unchanged O

Use the same project wrapper with this exact single body line:

```text
calculation c "C" id "00000000-0000-0000-0000-000000000002" { result Number; body 10000; }
```

Original source168 bytes; a genuine project p->next rename emits171 bytes, O=(1,0,195).
Desired includes the unchanged Number calculation c, same ID/name, no parameters,
and literal10000 expression. Original arena E=1. On a fresh pending corruption
fixture replace output expression [160,165) `10000` with `1 + 2` (five bytes).
The bytes still describe a Number calculation, now binary Add with two numeric
children: actual raw-expression arena E_actual=3. Bundle lengths/keys/entry/O
remain unchanged; complete equality must reject its different body. Use roomy
entries/bytes4096 from the original parse, not a policy replacement after emission.

The equality reservation must derive 3 from the freshly resolved actual output,
not trust pending's old scalar1. This fixture proves provenance/count selection;
its unequal root variants may short-circuit comparison and do not prove a frontier
actually exceeding1. Lowering already reserves five entries per actual node,
while equality requests only E_actual. No isolated equality-cap-minus-one refusal
is claimed; the earlier lowering peak may dominate. A meaningful additional
wide/deep positive and target-shape mismatch must be justified independently.

## Source basis and limits

At the pinned source, `rename/emission.rs:6` defines the sealed pending fields;
its output_slots counts all source/key/entry bytes, and emit_changed_unverified
reserves old plan+O before copies and drops old source before constructing pending.
`rename/emission/tests.rs` already pins literal NEXT and predecessor17/114.
`mixed/project.rs:245`/`:315` reserve the project alias/owner/table catalog; catalog
storage releases before returning resolved state. `mixed/project/accounting.rs`
seeds syntax and lower scratch independently; LowerStorage::all uses5N+2A.
`budget.rs::quoted_text` and raw_tokens StringEvent implement the P/D timing above.
These are logical storage derivations, not allocator/RSS or runtime test claims.