Tested source 29417130c7, branch codex/analysis-entry-producers-956atf-20260925, based on 97a8703adc75467a7f8e75f5c6cb00ca542b707c. Source and evidence are local-only: Gitea rejected publication with server No space left on device. The last confirmed remote evidence commit remains b2ef3f54. This does not change the published Windows preview or establish public source8 editing.

The contract adds an explicit combined text/entry producer route from actual carried authority. It preserves U syntax events and M's existing logical file/token-end/value-end/owner/projection inventory. Prospective checks precede selected growth; checked grammar counters and prepaid projection quota replace the old counting-work Vec on this route. Independent final inventory and once-only resolver transfer remain required.

evidence.zip: 434,046 bytes, 53 members, SHA256 19a87583a8dc4c22f35999044de5cac2c2c97b04fb457d2c3df3f6d2c054c865. manifest.json pins every raw member: original/final gates, launchers, input manifests, predecessor logs, two exact source patches, contract, design reviews and compiler-prologue observations. Seven readable review/checker mirrors match the archive exactly. The executable is identified, not included. Historical absolute paths identify the builder environment, not shared peer files.

Observed gates

Windows x86_64 gnullvm, Rust/Cargo1.98.1, LLVM-MinGW20260908, one Cargo job, CARGO_INCREMENTAL=0. No Linux/WSL build or check. Exact argument arrays and environment are in gates/*.result.json; readable commands from the pinned checkout:

cargo test --locked --offline -p oa-core --lib entry_producer -- --test-threads=1
cargo test --locked --offline -p oa-core --lib -- --test-threads=1
cargo test --locked --offline -p oa-core --lib -- --list
cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings
cargo fmt --all -- --check

Six new tests pass; full library fails with265 passed/16 inherited failed, 281 unique names. All275 prior outcomes and all ten existing stack controls are unchanged. Strict core all-target Clippy passes. Workspace formatting still fails with the byte-identical inherited eight blocks in five files. All16 failure bodies match the97a8703 baseline after numeric thread-identifier normalization only; the previous8d→97 framework-hint difference is not a new exception here.

All557 declared inputs match immutable Git and raw disk through final gates. Focused/full/list use the same42,898,944-byte executable, SHA256 adb0bd907f614c512bc3883dfe9a88ca0e4268638d85f4899ad07a5c1d3ec4e9. Initiala629ae01 compilation failed before tests: quota-test unwrap_err required Debug on a successful EditDeclaration vector. Finaltest uses explicit Err/Ok matching; production and expected outcomes are unchanged. Original compiler failure/receipt/source patch remain archived; no initial artifact/pass is claimed.

Review and finite scope

Source review records two precompile error-latch repairs: preserve the original failure during an overflow request, and check a zero-delta map replacement before mutation. Test review preserves the evaluator correction: an inventory walk requires scratch beyond exact syntax caps, so a separate roomy same-source owner is used. No live policy is widened. Literal oracles cover syntax13/12 and25/24 separately from resolver17/16 and29/28; owner/value prefix refusals4/7; and nested record, array, reference, UUID, nested declaration and node envelopes at syntax103/102. The nested fixture is syntax-only, not a semantically admitted Project.

Runtime review, readback JSON and reviewed checker reconcile actual logs, baseline archive, names, inputs, launcher semantics and current artifact. Stack observations record selected parser-chain reservation growth totaling2,048 bytes, separate projector changes and unchanged repaired binding/prefix sizes. These are partial compiler prologues, not measured total headroom. New tests use the normal harness stack; old pipeline setup limitations and prior-source repeated runs keep their original scopes. No new universal128KiB guarantee follows.

Existing traversal/delimiter/open/Pratt/duplicate-name scratch, token storage under its independent ceiling, numeric/decoder internals, model/validator heap, allocator overhead and native stack remain outside this retained metric. Pending projection instrumentation can change under an artificial direct call after a latched error, but actual parser paths immediately propagate and cannot return a poisoned witness. Actual emitted-output admission, whole-intent equality, accepted ownership and public/history integration remain separate unfinished work.