6.7 KiB
Independent actual-output acceptance critique
2026-09-25. Design-only readback of ACCEPTANCE-PROPOSAL.md SHA256 b59ca190e3cde85611158542ccf86e67c210b853b09a1fd0354daf57d4304509, the ownership source map and domain critique, against local source 29417130c71f70c4eaefe8ed4c879efba78eb72c. Entry runtime acceptance remains separate. No source edits, compiler, parser or network execution.
The proposed actual-byte parse/resolve/full-equality boundary is the useful next outcome. No further fixture-only intermediary is intrinsically required once the selected prerequisites pass. Prefer Candidate A as refined by OWNERSHIP-SOURCE-MAP: retain a complete immutable PendingRename reference, with lifetime shortening through its covariant desired Project borrow. This is simpler and stronger to inspect than projecting authority down to a bare Slots reference, and avoids Candidate B's unnecessary rearrangement of existing owning fields. Actual type checks must establish the proposed coercion and borrow scope; this review does not claim compilation.
Ownership and accounting decisions to retain
Pending's only production constructor is consumed emission (mixed/project/ordinary_index/rename/emission.rs:6 and its concluding construction). Its bundle, policy and retained Slots are private; emission reserves complete O before copies and drops the old indexed owner before Pending escapes. A from_pending constructor must accept the complete pending reference only and derive all views from that object. Keep guard variants private, add no arbitrary production tuple constructor, and do not copy the full policy into the guard. Existing output keys, entry and all files remain C through the new parse and resolver.
Put verification in a consuming Pending method. A local scope can borrow pending, use the strong text+entry route, consume syntax through existing project::resolve, reserve equality scratch on that resolved owner's live ledger, compare, then drop the resolved owner and all borrowing guards. Only afterward move the actual SourceBundle into a non-self-referential accepted owner. Returning borrowed syntax alongside it, resetting C to zero, defaulting policies or exposing a mutable Pending bundle would defeat this seam. None is needed. No-op remains the separately consuming original-owner branch.
Choose the accepted result's retained contents explicitly. If only bundle/policy/accepted authority survives, drop resolver warnings with verification storage. If warnings are retained or returned alongside it, their mapped strings/path copies and destination slots survive too and need an explicit transfer; final live storage is no longer O alone. mixed/project.rs currently reserves every mapped warning before pushing it (around lines 588–643). Do not silently clone warnings or equate excluded raw validator Issues with those counted mapped diagnostics. A small entry/default-span mismatch diagnostic is sufficient; recursive formatting of whole models is unnecessary.
Actual-expression equality bound
Use resolved_actual.project().eq(desired) under reserved E_actual = resolved_actual.expressions.len(), not the old pending scalar or rename::same_project. All current Project-to-Expr roots remain CalculationDefinition.body (analysis/types.rs:85–94), EngineeringProperty.base, AnalysisCase.overrides and AnalysisCheck.predicate (model.rs:667–682). Historical Trace/SemanticBaseline/FacetReview payloads are closed and contain ordinary strings/IDs/LifelineBinding rather than analysis Expr (semantic/types.rs:84–174, model.rs:526,1632–1650). The model/type/equality/lowering files are unchanged from the previously reviewed 18073a6 proof.
lower.rs:687–699,755–846 routes each real binding through expression lowering, emits one ExpressionSite per visited node, and schedules all child variants; mixed resolution retains this arena while merging model definitions/elements. analysis/expression_lifecycle.rs:170–270 keeps one iterative pair frontier, checks list/call shape before child insertion and never invokes another Expr equality with its frontier live. Pair members correspond to distinct nodes of the actual left tree, so every simultaneously live frontier is bounded by its actual tree size, hence E_actual. Sequential whole-Project field/container comparisons do not require summing all separate equality Vecs. E_actual may conservatively reject a comparison that would short-circuit; do not promise unconditional success with no phase headroom.
Make E_actual=0 explicit: derived Binding/parent variant checks reject target-only Expression before entering Expr::eq; no allocating equality call has a zero-node actual Expr. Keep whole-model PartialEq, including +0/-0 equivalence across geometry, ordinary and historical real carriers. Equality establishes semantic PartialEq, not bitwise target identity. Renew this reachability proof if Project payload types or expression production change.
Corruption controls and finite gates
Corrupted Pending tests must preserve their claimed live-storage provenance. Equal-byte replacements can change valid semantics, syntax or expression topology while retaining the authenticated O. Length-changing test mutations must either be rejected by an explicitly selected inventory invariant or construct an independently verified actual-O fixture under the inherited policy; keeping stale O after growing the bundle is not evidence of correct carried accounting. Especially test faulty actual output with more expression nodes than original E to demonstrate why E_actual is used.
Use one unchanged inherited profile for original parse/index/plan/emission and verification. Recompute the combined original and new-snapshot peaks; a syntax-only cap need not admit the independent counting walk, resolver catalogs or final equality. Require a real full-pipeline positive and a cap-minus-one that genuinely reaches the intended late stage, plus wrong-but-admissible names and non-name data, malformed/model-invalid output, E=0 target-only damage, actual wide/deep equality and signed zero. Drop original inputs and desired after success and inspect the independently owning returned bytes. Failed verification must yield only diagnostics and drop Pending, without exposing a usable partial bundle.
The domain critique's explicit independent bounds for named remaining scratch are compatible with this outcome; they must be selected and documented, not described as aggregate carried reservations. Existing bounds/exclusions do not exempt new output ownership, equality frontier or retained mapped diagnostics. Native verifier/drop frames require concrete measurements and existing stack controls; earlier separately unrerun setup failures are not converted to success by this design. Public source8, repeated retained editing and filesystem/history adoption remain separate contracts.