137 lines
7.4 KiB
Markdown
137 lines
7.4 KiB
Markdown
# Independent actual-output acceptance oracle — proposal only
|
|
|
|
Source inspected: `a629ae01d49bb3cb482a047eb41832ad4246a5c6`. Derived from literal
|
|
bytes and existing source, not parser/emitter execution. Only string lengths and
|
|
literal substring offsets were evaluated. Future verification API/domain/equality
|
|
contract is not yet selected; all runtime acceptance remains pending.
|
|
|
|
## Minimal real rename, one unchanged inherited policy
|
|
|
|
Entry/key `main.arcadia` has 12 ASCII bytes. Original exact source (final LF):
|
|
|
|
```text
|
|
arcadia 8;
|
|
project p "Project" id "00000000-0000-0000-0000-000000000001" {
|
|
|
|
}
|
|
```
|
|
|
|
Desired differs only in project alias `p` -> `next`. Expected complete emitted
|
|
bundle is exactly one file under the same entry/key, containing (final LF):
|
|
|
|
```text
|
|
arcadia 8;
|
|
project next "Project" id "00000000-0000-0000-0000-000000000001" {
|
|
|
|
}
|
|
```
|
|
|
|
Original source is 78 bytes; output is 81. The sole edit is original [19,20),
|
|
replacement `next` (four bytes); output alias is [19,23), display text [25,32),
|
|
UUID quoted token [37,75). Output retained O=(1 entry, 0 occurrences, 105 text),
|
|
where 105=81 source+12 map key+12 entry bytes. No output key/path is omitted.
|
|
|
|
Complete expected Project: schema_version=8; id=00000000-0000-0000-0000-000000000001;
|
|
alias="next"; name="Project"; description=""; definitions, elements, relations,
|
|
diagrams, artifact_links and traces are all empty maps. Expected warnings empty.
|
|
This asserts every model field, not just the changed alias. E_original=E_actual=0.
|
|
|
|
Select original Limits entries=17, bytes=152 (or 151 negative), all other fields
|
|
unchanged from an admissible roomy source8 profile; keep the same ProjectLimits
|
|
through original parse/index/plan/emission/verification. Never tighten live policy.
|
|
|
|
| Stage | Logical entries | Logical text | Derivation |
|
|
| --- | ---: | ---: | --- |
|
|
| Original syntax retained |12|8|U1 + M11; alias1+name7 |
|
|
| Original resolver peak |16|10|Project catalog +4 entries, two alias copies |
|
|
| Original typed index retained |13|9|One global name; no typed headers/expressions |
|
|
| Original ordinary index retained |14|9|One authored project header |
|
|
| Rename plan peak/retained |16|9|R1 name target + namespace Q1 (then dropped), M1 edit |
|
|
| Emission overlap |17|114|Plan16/9 + output O1/105 |
|
|
| Output strong syntax retained |13|116|C1 + U1 + M11; C105 + T11 |
|
|
| Output resolver peak |17|124|Syntax13 + project catalog4; two four-byte alias copies |
|
|
| Output resolved retained/equality |13|116|Catalog dropped; E_actual0 equality scratch |
|
|
| Owning accepted bundle after verification owners drop |1|105|Only actual output O remains |
|
|
|
|
Original indexing/transient peaks do not exceed the original resolver/plan/emission
|
|
entry ceiling17 for this empty model; prior emitted-overlap source tests explicitly
|
|
use entries17 and bytes114 through the real predecessor path. The new proposed
|
|
152/151 byte profiles are looser than that already authored predecessor boundary.
|
|
No new verification allocation occurs while the old authored owner remains live.
|
|
|
|
## Exact new byte boundary and timing
|
|
|
|
Scanner validation of the output UUID reserves raw payload36 before decoding.
|
|
No grammar text exists during that file scan: C105+W36=141 (display payload7 is
|
|
smaller). Grammar first retains alias4 and display name7, hence T11. Its UUID
|
|
consumer reserves P36 while T11 remains live: 105+11+36=152, before the existing
|
|
serde decode. Valid decode D36 transfers then UUID parsing drops/refunds it;
|
|
final T11 and W0. Project has no projected ordinary values or textual keys.
|
|
|
|
Therefore 152 is the full-pipeline positive byte cap and 151 isolates the new
|
|
actual-output grammar producer refusal, after predecessors/emission and scanner
|
|
have fit. Expected source path main.arcadia, code invalid_source, message
|
|
`Source8 index/output byte limit exceeded.`, ordinary transported span [37,38),
|
|
line2 column27, no related locations. Raw quoted extent is [37,75), but the
|
|
ordinary error transport intentionally retains its one-byte start representation.
|
|
Do not expect this refusal at the former unverified-emission114 boundary.
|
|
|
|
Entry cap17 permits the whole pipeline, but cap16 refuses **emission first**:
|
|
plan16 plus O1 cannot fit. Thus it cannot demonstrate a later verification/resolver
|
|
entry refusal. Equality reserves zero here; no equality-specific minus-one case
|
|
exists. A different justified fixture is needed for any proposed late entry gate.
|
|
|
|
## Equal-byte corruption controls (not genuine emitted results)
|
|
|
|
Start each control from a fresh legitimately emitted pending owner under roomy
|
|
unchanged inherited limits. Mutate only in the private fixture harness. Equal UTF-8
|
|
length preserves O numerically; production must not expose mutation/constructors.
|
|
|
|
- Output alias [19,23): `next` -> `nope`. Valid alias and otherwise empty model;
|
|
parse/admission should pass, complete Project equality must reject.
|
|
- Output name [25,32): `Project` -> `Changed`. Valid decoded display name, same
|
|
seven bytes; parse/admission should pass, non-name equality must reject.
|
|
- Version byte [8,9): `8` -> `?`. Equal bytes, malformed source; scanner/parser
|
|
must reject before model equality. Do not claim a successful wrong-model case.
|
|
|
|
Each failure must drop pending verification state, return no accepted owner, and
|
|
leave original source and desired unchanged. Do not recursively format models.
|
|
The new verifier's semantic-mismatch message is deliberately unspecified here.
|
|
|
|
## Actual expression count larger than original, unchanged O
|
|
|
|
Use the same project wrapper with this exact single body line:
|
|
|
|
```text
|
|
calculation c "C" id "00000000-0000-0000-0000-000000000002" { result Number; body 10000; }
|
|
```
|
|
|
|
Original source168 bytes; a genuine project p->next rename emits171 bytes, O=(1,0,195).
|
|
Desired includes the unchanged Number calculation c, same ID/name, no parameters,
|
|
and literal10000 expression. Original arena E=1. On a fresh pending corruption
|
|
fixture replace output expression [160,165) `10000` with `1 + 2` (five bytes).
|
|
The bytes still describe a Number calculation, now binary Add with two numeric
|
|
children: actual raw-expression arena E_actual=3. Bundle lengths/keys/entry/O
|
|
remain unchanged; complete equality must reject its different body. Use roomy
|
|
entries/bytes4096 from the original parse, not a policy replacement after emission.
|
|
|
|
The equality reservation must derive 3 from the freshly resolved actual output,
|
|
not trust pending's old scalar1. This fixture proves provenance/count selection;
|
|
its unequal root variants may short-circuit comparison and do not prove a frontier
|
|
actually exceeding1. Lowering already reserves five entries per actual node,
|
|
while equality requests only E_actual. No isolated equality-cap-minus-one refusal
|
|
is claimed; the earlier lowering peak may dominate. A meaningful additional
|
|
wide/deep positive and target-shape mismatch must be justified independently.
|
|
|
|
## Source basis and limits
|
|
|
|
At the pinned source, `rename/emission.rs:6` defines the sealed pending fields;
|
|
its output_slots counts all source/key/entry bytes, and emit_changed_unverified
|
|
reserves old plan+O before copies and drops old source before constructing pending.
|
|
`rename/emission/tests.rs` already pins literal NEXT and predecessor17/114.
|
|
`mixed/project.rs:245`/`:315` reserve the project alias/owner/table catalog; catalog
|
|
storage releases before returning resolved state. `mixed/project/accounting.rs`
|
|
seeds syntax and lower scratch independently; LowerStorage::all uses5N+2A.
|
|
`budget.rs::quoted_text` and raw_tokens StringEvent implement the P/D timing above.
|
|
These are logical storage derivations, not allocator/RSS or runtime test claims.
|