Independent actual-output acceptance oracle — proposal only

Source inspected: a629ae01d49bb3cb482a047eb41832ad4246a5c6. Derived from literal bytes and existing source, not parser/emitter execution. Only string lengths and literal substring offsets were evaluated. Future verification API/domain/equality contract is not yet selected; all runtime acceptance remains pending.

Minimal real rename, one unchanged inherited policy

Entry/key main.arcadia has 12 ASCII bytes. Original exact source (final LF):

arcadia 8;
project p "Project" id "00000000-0000-0000-0000-000000000001" {

}

Desired differs only in project alias p -> next. Expected complete emitted bundle is exactly one file under the same entry/key, containing (final LF):

arcadia 8;
project next "Project" id "00000000-0000-0000-0000-000000000001" {

}

Original source is 78 bytes; output is 81. The sole edit is original [19,20), replacement next (four bytes); output alias is [19,23), display text [25,32), UUID quoted token [37,75). Output retained O=(1 entry, 0 occurrences, 105 text), where 105=81 source+12 map key+12 entry bytes. No output key/path is omitted.

Complete expected Project: schema_version=8; id=00000000-0000-0000-0000-000000000001; alias="next"; name="Project"; description=""; definitions, elements, relations, diagrams, artifact_links and traces are all empty maps. Expected warnings empty. This asserts every model field, not just the changed alias. E_original=E_actual=0.

Select original Limits entries=17, bytes=152 (or 151 negative), all other fields unchanged from an admissible roomy source8 profile; keep the same ProjectLimits through original parse/index/plan/emission/verification. Never tighten live policy.

Stage	Logical entries	Logical text	Derivation
Original syntax retained	12	8	U1 + M11; alias1+name7
Original resolver peak	16	10	Project catalog +4 entries, two alias copies
Original typed index retained	13	9	One global name; no typed headers/expressions
Original ordinary index retained	14	9	One authored project header
Rename plan peak/retained	16	9	R1 name target + namespace Q1 (then dropped), M1 edit
Emission overlap	17	114	Plan16/9 + output O1/105
Output strong syntax retained	13	116	C1 + U1 + M11; C105 + T11
Output resolver peak	17	124	Syntax13 + project catalog4; two four-byte alias copies
Output resolved retained/equality	13	116	Catalog dropped; E_actual0 equality scratch
Owning accepted bundle after verification owners drop	1	105	Only actual output O remains

Original indexing/transient peaks do not exceed the original resolver/plan/emission entry ceiling17 for this empty model; prior emitted-overlap source tests explicitly use entries17 and bytes114 through the real predecessor path. The new proposed 152/151 byte profiles are looser than that already authored predecessor boundary. No new verification allocation occurs while the old authored owner remains live.

Exact new byte boundary and timing

Scanner validation of the output UUID reserves raw payload36 before decoding. No grammar text exists during that file scan: C105+W36=141 (display payload7 is smaller). Grammar first retains alias4 and display name7, hence T11. Its UUID consumer reserves P36 while T11 remains live: 105+11+36=152, before the existing serde decode. Valid decode D36 transfers then UUID parsing drops/refunds it; final T11 and W0. Project has no projected ordinary values or textual keys.

Therefore 152 is the full-pipeline positive byte cap and 151 isolates the new actual-output grammar producer refusal, after predecessors/emission and scanner have fit. Expected source path main.arcadia, code invalid_source, message Source8 index/output byte limit exceeded., ordinary transported span [37,38), line2 column27, no related locations. Raw quoted extent is [37,75), but the ordinary error transport intentionally retains its one-byte start representation. Do not expect this refusal at the former unverified-emission114 boundary.

Entry cap17 permits the whole pipeline, but cap16 refuses emission first: plan16 plus O1 cannot fit. Thus it cannot demonstrate a later verification/resolver entry refusal. Equality reserves zero here; no equality-specific minus-one case exists. A different justified fixture is needed for any proposed late entry gate.

Equal-byte corruption controls (not genuine emitted results)

Start each control from a fresh legitimately emitted pending owner under roomy unchanged inherited limits. Mutate only in the private fixture harness. Equal UTF-8 length preserves O numerically; production must not expose mutation/constructors.

Output alias [19,23): next -> nope. Valid alias and otherwise empty model; parse/admission should pass, complete Project equality must reject.
Output name [25,32): Project -> Changed. Valid decoded display name, same seven bytes; parse/admission should pass, non-name equality must reject.
Version byte [8,9): 8 -> ?. Equal bytes, malformed source; scanner/parser must reject before model equality. Do not claim a successful wrong-model case.

Each failure must drop pending verification state, return no accepted owner, and leave original source and desired unchanged. Do not recursively format models. The new verifier's semantic-mismatch message is deliberately unspecified here.

Actual expression count larger than original, unchanged O

Use the same project wrapper with this exact single body line:

calculation c "C" id "00000000-0000-0000-0000-000000000002" { result Number; body 10000; }

Original source168 bytes; a genuine project p->next rename emits171 bytes, O=(1,0,195). Desired includes the unchanged Number calculation c, same ID/name, no parameters, and literal10000 expression. Original arena E=1. On a fresh pending corruption fixture replace output expression [160,165) 10000 with 1 + 2 (five bytes). The bytes still describe a Number calculation, now binary Add with two numeric children: actual raw-expression arena E_actual=3. Bundle lengths/keys/entry/O remain unchanged; complete equality must reject its different body. Use roomy entries/bytes4096 from the original parse, not a policy replacement after emission.

The equality reservation must derive 3 from the freshly resolved actual output, not trust pending's old scalar1. This fixture proves provenance/count selection; its unequal root variants may short-circuit comparison and do not prove a frontier actually exceeding1. Lowering already reserves five entries per actual node, while equality requests only E_actual. No isolated equality-cap-minus-one refusal is claimed; the earlier lowering peak may dominate. A meaningful additional wide/deep positive and target-shape mismatch must be justified independently.

Source basis and limits

At the pinned source, rename/emission.rs:6 defines the sealed pending fields; its output_slots counts all source/key/entry bytes, and emit_changed_unverified reserves old plan+O before copies and drops old source before constructing pending. rename/emission/tests.rs already pins literal NEXT and predecessor17/114. mixed/project.rs:245/:315 reserve the project alias/owner/table catalog; catalog storage releases before returning resolved state. mixed/project/accounting.rs seeds syntax and lower scratch independently; LowerStorage::all uses5N+2A. budget.rs::quoted_text and raw_tokens StringEvent implement the P/D timing above. These are logical storage derivations, not allocator/RSS or runtime test claims.

7.4 KiB Raw Blame History