8.3 KiB
Exploratory critique: topology-preserving verification envelope
2026-09-24; source base ee500908e3d77182ddd54e12524f9b6c6eb43b60 and reviewed private rename planner. Read-only investigation; no implementation or Cargo. Paths below begin at crates/oa-core/src/. This is not an accepted architecture or runtime cap result.
Conclusion: a parser-only conservative envelope is a viable alternative to intrusive parser accounting, provided actual emitted bytes are authenticated before relying on original topology, and the envelope explicitly covers transient copies. Neither original resolved B nor B plus the source-length delta is a demonstrated bound. Prefer a small independent envelope proof/count experiment before choosing parser instrumentation; do not yet ship a guessed multiplier.
Topology argument and malformed output
model.rs:1739–1746 allows only ASCII letter/underscore followed by ASCII alphanumeric/underscore names, excluding reserved spellings. This is exactly the raw Word alphabet (language/raw_tokens.rs:61–70). Replacing an entire authenticated Word with another such name preserves the token's class and its boundaries against unchanged surrounding bytes. It cannot create a quote, comment marker, delimiter, whitespace or numeric token. All syntax keywords, punctuation, literals and include strings remain untouched. The original typed/ordinary maps identify name grammar positions; final simultaneous namespace validation preserves qualified identities through swaps. Consequently token count, AST/position/expression topology, nesting and the include graph remain the same; byte offsets and stored name lengths change.
This reasoning applies to the specified edit stream, not arbitrary bytes produced by a buggy emitter. Before dropping the original owner, compare the actual complete output entry/path set and every file against the concatenation of original untouched slices and authorized replacement strings. Do this as a checked streaming comparison, with no second output buffer or re-lexing. Output must already have its F/content/path/entry reservations before construction. Reject a mismatch before parsing; keep the authenticated output privately owned and immutable through verification. A hash or a promise that the emitter is correct is not this guard. Without it, a malformed output could introduce arbitrarily different topology within the byte cap and invalidate an old-topology envelope before the parser refuses it.
Actual output parsing/resolution/whole-Project equality remain mandatory after this guard. The guard preserves non-name bytes; semantic equality alone cannot. Malformed-emitter controls would intentionally stop at the guard, whereas independent parser refusal tests exercise the parser separately.
Concrete terms absent from a simple retained-B bound
| Carrier | Required contribution / source |
|---|---|
| Retained syntax and name text | Enumerate original syntax nodes/text and translate authenticated name lengths. Ordinary Reference spellings exist in both Ast and projected EditKind (language.rs:1087); a single source-byte delta undercounts their growth. |
| Projection token ends and delimiters | edit_positions_from_tokens allocates ends with one slot per significant token and a delimiter stack (language.rs:1023–1035) while tokens/AST/value-end metadata already exist. Add these transient terms; they are not established by retained final index counts. |
| Projection counting walk | mixed.rs:379–405 has an additional Vec of Ast references. Its frontier is bounded by original ordinary value count; it runs before projection. Use a phase maximum instead of automatically summing both scratch peaks. |
| Typed declaration scratch | declarations.rs:284–300 owns parameter-name and parameter-ID sets plus a borrowed field-name set. Names are cloned separately from retained parameter Reference strings. Override target names have another set (:604–610). |
| Typed expression scratch | syntax.rs:15–39,225,393–401 has task/value vectors, sequence vectors, cloned call-label duplicate-detection keys and conversion overlap. Bound suspended nested sequences by original argument/node/frame counts; E alone is not a proved multiplier for all these containers. |
| String scanning/decoding | The raw scanner validates quoted strings using a temporary decoded String (raw_tokens.rs:127); the parser later decodes them again (language.rs:1194–1201, cursor.rs:82–95). Unchanged literal token lengths give a conservative maximum for transient decoded text, including UUID strings not retained as strings. |
| Traversal/path work | Same include graph means actual F/include counts and paths are unchanged. Nevertheless folded keys, stack/active/visited/children and cloned target/origin paths coexist (source_project/traversal.rs:8–17,55–92,96–191). Path normalization also allocates component Vecs, uppercase component strings and joined paths (source_project.rs:120–164). Count these explicitly. Unicode lowercase expansion must be measured/bounded, not assumed byte-neutral. |
| Collection transitions | Parsed canonical BTreeMap to file Vec (mixed.rs:374) and sequence collection conversions require an explicit logical-live overlap rule. No allocator-capacity/RSS claim follows from logical slots. |
These terms are finite and source-derived. Include scratch can be bounded using actual authored include-edge count plus F and maximum/path-sum lengths, rather than default maximum limits. Name growth needs role-weighted copy counts or a separately proved conservative maximum multiplicity; several carriers demonstrably require two simultaneous copies. No complete universal multiplicity was proved in this bounded investigation.
An ordinary-heavy route/array fixture is particularly important: significant token count can grow substantially while retained name/index additions remain small. The projection's extra token-end vector therefore cannot be justified merely by pointing to later name/index headroom. This rejects the proposed inference B≥earlier parser peak; it is not a claim that a particular measured fixture exceeded B. A formal phase accounting or measurement-backed bound is still needed.
Minimal compatible use and comparison
Use this envelope only for parsing first. After the authenticated old owner drops, reserve O+Vparse, where O is all owned output slots/text and Vparse is the proved parser peak under transformed name lengths. Parse under the exact inherited per-snapshot Limits/ProjectLimits. Then transfer the admitted retained syntax subtotal into the existing resolver with carried O, releasing only the envelope excess. The resolver still needs its narrow baseline seam; final whole-Project equality still needs E. Do not reserve Vparse forever alongside the resolver's own syntax reservation or silently forget O at handoff.
| Choice | Useful caps / proof / maintenance |
|---|---|
| Topology envelope + exact-byte guard | Avoids pervasive parser edits and preserves existing parse semantics. Can use actual original shape and phase maxima, so potentially useful under normal profiles. Conservative copies can reject tight profiles. Duplicates an inventory of parser allocations and must change whenever those sites change. |
| Carried-ledger parser path | Charges actual live phases and can admit cases rejected by a loose envelope. Broader implementation/testing surface, especially shared parser/traversal seams. Allocation changes remain closer to their checks, reducing long-term proof drift. |
| Reserve hard limits or an unexplained B/byte multiple | Reject: hard-limit reservation plus nonempty output often leaves no admissible headroom; unexplained multipliers have no safety proof. |
Next discriminating step: independently enumerate Vparse entries/text for a tiny project, rich OA/SA, ordinary-heavy64-route-point category, wide/deep typed expressions, nested calls, long renamed parameters and include-heavy paths. Count copy multiplicities and phase overlap from source, including the guard's own zero-container walk. Demonstrate a realistic inherited cap that passes emission and O+Vparse, plus cap-minus-one refusal before parsing; compare with a tighter actual-live estimate to quantify false rejection. No such executable acceptance experiment was run here. If the count walker becomes a second parser lifecycle implementation or rejects ordinary useful cases, choose carried-ledger instrumentation instead.