103 lines
6.3 KiB
Markdown
103 lines
6.3 KiB
Markdown
# Private retained-entry producer prerequisite
|
|
|
|
Baseline `97a8703adc75467a7f8e75f5c6cb00ca542b707c`. This selected contract
|
|
strengthens the timing of the existing logical entry metric. It does not grant
|
|
accepted-output, public source8 or save/history authority. Source/evidence remain
|
|
local until the Gitea storage publication blocker is resolved.
|
|
|
|
## Metric and authority
|
|
|
|
Add one explicit fixture route enabling both text and entry producers, using the
|
|
existing opaque CarriedInput and exact inherited policy. Preserve legacy,
|
|
carried-phase and text-only routes and their diagnostic timing. C comes from the
|
|
actual carried guard, including an explicitly selected zero guard.
|
|
|
|
U remains exactly Budget.usage.entries, the existing cumulative syntax events.
|
|
M remains F supplied file records + one significant-token-end subtotal + unique
|
|
ordinary value-end keys + ordinary lexical-owner occurrences + projected slots.
|
|
Projected slots remain seven per ordinary declaration (including its synthetic
|
|
body and conservative header envelope), one per field, one per actual Ast value.
|
|
Node headers also retain the seven envelope. Dropped token/value-end structures
|
|
keep their conservative subtotal through syntax return. Usage never includes C,
|
|
M or quota consumption, and significant tokens do not gain a second M charge.
|
|
|
|
Before selected growth check checked `C.entries + U + M + delta` against the
|
|
exact entry ceiling. A failed check changes no U/M total. Use only small scalar
|
|
optional Budget state; do not duplicate policy or create another owning wrapper.
|
|
Preserve current byte/guard checks, then atomically validate/install C and M=F
|
|
before Traversal construction. F is transferred, not charged again, when file
|
|
records move between containers.
|
|
|
|
## Producer and reconciliation rules
|
|
|
|
- Budget::entry preserves its existing syntax-work check first; in the new mode
|
|
check the prospective aggregate before incrementing U or returning to callers.
|
|
Existing typed/ordinary event sites remain unchanged.
|
|
- Encapsulate value-end key-presence check, reservation and insertion in one State
|
|
helper. Charge only a new key. Encapsulate lexical-owner reservation and push
|
|
likewise; charge occurrences, not distinct UUIDs. Hide unchecked mutable
|
|
metadata access from the ordinary parser.
|
|
- Count pending projection with checked scalar grammar hooks: seven per ordinary
|
|
declaration, one per successfully parsed field and one per successful value.
|
|
Nested values/fields naturally contribute. Project/include/description do not
|
|
call these hooks; duplicate fields fail the entire parse. The synthetic body
|
|
is already in seven, and adds no value event.
|
|
- At projection boundary atomically reserve token count plus pending projection
|
|
into M before ends/header/field/value construction. The stronger route must
|
|
not call the old unmetered borrowed-work Vec counting pass. Other routes keep
|
|
that existing path.
|
|
- A scalar prepaid quota is consumed before projector growth: seven before a
|
|
declaration/header envelope, one before each field, one before each actual
|
|
value (before recursive children). It neither recharges nor refunds M. Require
|
|
zero after projection. Under/over quota is an internal invariant failure,
|
|
never a successful witness with corrected/subtracted counts.
|
|
- After each file compare reserved map/owner counts with actual lengths and
|
|
M delta with checked token/owner/map/projected inventory. At syntax completion
|
|
compare total M with the independently accumulated metadata field. Keep the
|
|
existing once-only C then U+M resolver ledger transfer; text reconciliation
|
|
remains unchanged. Never seed a combined total and add syntax a second time.
|
|
|
|
## Rejection behavior
|
|
|
|
New aggregate ceiling refusal uses `Source8 lowering entry limit exceeded.`
|
|
Overflow uses `Source8 producer entry size overflow.` Both latch in the new
|
|
entry mode, leave totals unchanged and propagate immediately. Legacy phase
|
|
checks keep their existing nonlatching semantics. U-only failure retains its
|
|
existing precedence and message. Invariant mismatches return an explicit error;
|
|
they cannot silently repair a count or produce an accepted result.
|
|
|
|
Attribute U to its existing event span; owner to the original declaration start;
|
|
value-end to the completed Ast's start/end; file and complete projection
|
|
reservation to Span::default in the current file. Grammar counter overflow uses
|
|
its corresponding declaration/field/value span. Ordinary diagnostic transport
|
|
continues to use the existing one-byte start representation. Tests distinguish
|
|
these actual seam diagnostics from later phase or resolver refusal.
|
|
|
|
## Acceptance and exclusions
|
|
|
|
Real E: C1/U1/M11 gives syntax13/12; full resolver17/16 is a separate boundary.
|
|
Real three-file chain: C3/U3/M19 gives syntax25/24, separate resolver29/28.
|
|
Use sufficiently large unchanged text policies (at least E146 and chain358),
|
|
so earlier text limits cannot preempt the entry assertion. First ordinary owner
|
|
refuses at prefix cap4; first description value-end refuses at prefix cap7.
|
|
Neither next integer is claimed to admit the complete document. Review the
|
|
reserve-plus-mutate helpers and test unchanged collections on refusal directly.
|
|
|
|
Independently author a nested record/array/reference/historical UUID fixture and
|
|
node/element envelopes, with literal counts and spans fixed before runtime.
|
|
Cover repeated map keys, quota underflow/leftover, overflow and latched refusal
|
|
as labeled internal controls. Verify actual-owner and explicit C0 routes,
|
|
whole OA/SA and multi-file Project/Usage/numeric parity against text-only, source
|
|
conservation, once-only transfer and unchanged old caps/errors. Run new focused
|
|
cases, full existing disposition, strict core Clippy and format comparison;
|
|
inspect changed Budget/State/projector prologues and all old small-stack controls.
|
|
Do not enlarge stacks, loosen tests or add a heap wrapper to hide regressions.
|
|
|
|
This retained metric does not bound allocator capacity/node overhead, file-table
|
|
physical transfer overlap, significant-token storage beyond its existing token
|
|
bound, traversal/open-declaration/delimiter/Pratt work stacks, duplicate-name
|
|
scratch, numeric/decoder internals, model/validator heap or native stack. Those
|
|
named scratch domains need a later explicit finite decision. Actual emitted-byte
|
|
verification, justified whole-Project equality work and accepted bundle ownership
|
|
also remain open. No claim of before-every-allocation or all-heap accounting.
|