# Private owned emission and parser stack repair

Source **8d52dab97c92cc31baae9f20d8c324b55818aa5d** is pushed and ref-verified
on `codex/analysis-mixed-emission-956atf-20260925`. It implements the
[private emission contract](../../analysis-mixed-emission-contract-20260925.md):
consume a validated rename plan, preserve its exact owner for unchanged output,
or reserve complete owned output storage before copying changed files once in
original edit coordinates. Changed output is opaque and unverified; the exact
policies and desired whole Project survive. Borrowed carried owners are refused
on the changed path because dropping their guard cannot free their backing
allocation. There is no public source8, save/history or accepted-output authority.

Windows gnullvm, rustc/Cargo 1.98.1: **11 new tests pass**, strict core all-target
Clippy passes and the listing contains **269 names**. The full library remains
**FAILED: 253 passed / 16 failed**. All 258 prior outcomes and all 16 failure
bodies match fa7a980 after normalizing only numeric thread identifiers.
Formatting remains **FAILED** on eight inherited blocks in five files, with
byte-identical output. Linux/WSL checks were not run.

[Source review](SOURCE-REVIEW.md), [test review](TEST-REVIEW.md) and the
[independent oracle](../../analysis-mixed-emission-design-20260925/EMISSION-ORACLE.md)
cover complete OA/SA bytes, Unicode/CRLF, scoped and global swaps, untouched
files, freshness and branch refusal, policy/lifetime retention, exact storage
caps and scoped drop behavior. Minimal and three-file fixtures reach real
emission peaks of 17 entries / 114 text bytes and 29 / 216 respectively;
their cap-minus-one controls pass predecessor phases and refuse emission.
The no-op returns the original owner below output-copy overlap limits.
Two fixture issues were corrected before execution and are disclosed in the
test review; neither is presented as a runtime failure.

The [stack diagnosis](STACK-DIAGNOSIS.md) preserves source19a4082's initial
full-run abort after 135 completed passes. All eleven new focused cases had
passed, but an unchanged 128 KiB ordinary-index control overflowed during its
upstream numeric parsing. Exact-artifact LLDB and prologue records are retained.
The [mechanically reviewed repair](STACK-REPAIR-REVIEW.md) splits the iterative
binding driver into prefix and continuation operations while preserving task
order, containers, accounting, limits and tests. Final numeric-prefix prologue
reservations total 14,240 bytes instead of 27,272, a 13,032-byte reduction.
This is not a complete stack bound. The unchanged control passes the final
full suite and three additional fresh processes with no stack override.
The older separate full-pipeline setup overflow has not been rerun or relabeled.

[Runtime review](RUNTIME-REVIEW.md) verifies 555 declared inputs against immutable
Git and raw disk bytes, exact launchers, baseline records, logs and the final
42,402,816-byte test artifact, SHA256
`29d8a4761fd8f09a3c0eafeb11cca07f0d45c711bf1b969d97c8b29d2b3ab446`.
The initial artifact is identified by its own receipt and retained locally;
neither executable is included in this evidence archive.

[evidence.zip](evidence.zip) contains **65 members, 479,039 bytes**, SHA256
`8d46b31379d75567b195b639cb3bc289ad1c9d26df53d29dbfd99ba22e38c5b9`.
[manifest.json](manifest.json) pins each member.

The archive preserves initial and final gates, exact launchers, three control
rechecks, debugger/prologue observations, baseline records, source patches,
contract snapshots and reviews. Seven readable review/checker files are exact
archive mirrors. Toolchain version text is an earlier unchanged capture.
The independent package readback is [recorded separately](PACKAGE-READBACK.md).

Reproduce from the identified source with the project Windows toolchain, one
compiler job, `CARGO_INCREMENTAL=0`, and no lifecycle or RUST_MIN_STACK override:

```text
cargo test --locked --offline -p oa-core --lib -- --list
cargo test --locked --offline -p oa-core --lib emission -- --test-threads=1
cargo test --locked --offline -p oa-core --lib -- --test-threads=1
cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings
cargo fmt --all -- --check
```

Helpers retain the producing machine's layout and must be read before reuse.
The [readback checker](inspect_runtime.py) validates evidence without launching
Cargo or the binary. Receipts bind declared inputs and recorded environment,
not exhaustive machine state or authenticated build provenance. Debugger exit
zero after killing the stopped process is not a passing test. Archived diagnostic
helpers are recipes; their corresponding receipts identify actual executions.

Actual-output parse/resolve/admission, complete Project equality under justified
scratch bounds, stronger parser producer timing and an owning accepted result
remain required. Original expression counts alone do not bound arbitrary faulty
output. This branch-specific prerequisite is separate from the published preview;
live coordination and broader acceptance remain in issue #7.