ARCADIA-Studio/harness/analysis-mixed-emission-contract-20260925.md

Private mixed rename emission prerequisite

2026-09-25. Selected private prerequisite following bounded design and independent ownership/oracle review; implementation and runtime acceptance pending. Source baseline: fa7a980418ef99d772e67c66c28dfa7b5181f875. This implements the output construction and old-owner lifetime portion of the rename successor. It does not implement accepted output, public source8, persistence or history. The carried parser prerequisite and its remaining before-growth limitations retain their stated scope. The producer inventory, independent critique, transition proposal and contract review with ownership correction record candidates and rationale. This selected contract supersedes conflicting earlier proposal choices, including the owning enum and runtime byte guard.

Ownership and API

Consume the opaque RenamePlan and borrow a complete current SourceBundle. Revalidate current entry, complete file set, paths and all bytes against the original snapshot before any copying, including for no-op. Reuse the planner's complete physical edit validation; no external edit list, Project or policy may replace its authority.

If no names changed, return the original AuthoredMixedProject unchanged, with its actual bundle, policy, work usage, warnings and storage. Allocate no output. The changed result owns a complete pending bundle, the exact inherited Limits and ProjectLimits, its verified output storage total O, the desired Project borrow and scalar original expression-site count E. It retains no old syntax, catalog, warning, index or plan map. Original caller-owned source and desired Project remain untouched. This does not claim those external borrows are freed.

Keep pending fields private. Expose no bundle extraction, mutation, installation, history, save or accepted-result conversion. Tests may inspect fields. No general constructor accepting arbitrary bundle/Slots/policy is authorized. The only construction path consumes the actual plan after checked emission. Reuse or add a sealed carried-snapshot connection only if it accepts this actual pending owner, never loose parts; invoking parser verification remains outside this slice.

For changed emission in this prerequisite require original legacy syntax (carried == None). Reject an explicit carried source before output reservation, even its borrowed-zero mode. Dropping a source witness only drops its guard; an external RetainedSnapshot would remain alive, so claiming only O survived would hide C. Future repeated owned editing needs an explicitly consuming owner transition or surviving C guard. No-op may preserve any source and its guard unchanged, because no old reservation is discarded. This narrow provenance restriction is intentional, not a numeric-zero shortcut or a final editing API.

Select two explicit consuming methods: into_unchanged(self, current) -> Result<AuthoredMixedProject<'s>, Failure> and emit_changed_unverified(self, current) -> Result<PendingRename<'t>, Failure>. Both validate current snapshot and complete edits and enforce their branch; calling the wrong branch refuses. Callers can select using the existing immutable changed_names().is_empty() observation. A branch cannot change after that read. This separates source and desired lifetimes without boxing, a large common owning result enum, generic callback machinery or lint exemptions. Do not duplicate full policy inside old syntax owners. Keep all existing stack controls.

Storage and construction

Let B be the existing plan owner's live ledger, which already includes both the R changed-name entries and M physical-edit entries. Do not add R+M twice. Compute the complete final file byte sum S using the existing checked original coordinate sizing walk, including untouched files. Then compute

O.entries = original complete file count F
O.occurrences = 0
O.text = S + sum(canonical key UTF-8 byte lengths) + entry UTF-8 byte length
peak during emission = B + O

Every addition/subtraction must be checked. Reserve all O against the original ledger and exact inherited policy before constructing any output String, copied key, entry or map element. Reserving the complete monotone output up front covers its partial construction; capacity/allocator overhead remain outside the logical metric. Original sources and desired replacement aliases are borrowed during copying. No lengths map, copied edit list, temporary complete file or second output buffer is needed. Any additional owned container requires explicit scope and reservation before growth. Source-size shrinkage does not release old B.

Walk canonical files and the sorted edit stream. For each file, append original untouched ranges and the exact qualified target's desired alias in original byte coordinates, then the tail. Produce one String per file, including untouched files; preserve complete paths and entry. Avoid reparsing, decoding, UUID creation, normalization and global textual replacement. Validate original UTF-8 boundaries and nonoverlap through the existing complete edit validator before construction. Check the constructed length against independently computed size before ownership transition. Check final complete file count and byte total without a second copy.

Capture policy and E as scalars; destroy old plan maps and the complete old source owner explicitly before returning the pending owner. O is then the only retained in-scope owner from this operation. Failure yields existing located diagnostics and drops partial output; no partial owner escapes. Preserve failure ordering: stale snapshot, invalid edit map/size, output storage reservation, construction consistency; changed carried-source refusal precedes output reservation. Arithmetic fault injection must be labeled as such, not successful real-world owner provenance.

Verification and remaining boundary

Use independent literal original-coordinate maps and expected full bytes for OA and SA, simultaneous global/scoped swaps, repeated/reordered labels, cross-file references, ordinary categories, Unicode/CRLF and comments. Verify copied untouched files and exact entry/keys. No-op must preserve original owner data/pointers, not an equivalent reconstructed owner. Corrupt current touched/untouched data, paths, entry and file set, and corrupt plan edit locations/targets through test-only access; require no result. Reuse valid planner tests where they cover the same validator rather than duplicate all cases.

Independently hand-count a small real fixture's B and O. Choose exact entry/text caps that admit all predecessor phases and refuse cap-minus-one at emission. Do not mutate an admitted live ledger or widen policy to manufacture this test. Assert final O, original exact policies, desired borrow and E. Include combined grow/shrink and unchanged-file sizing. Small-stack emission/drop checks prepare parser prerequisites on the normal thread, then move the complete consumed plan into the worker; preserve all prior full-pipeline controls and limitations.

Independent byte fixtures test the emitter; the pending type does not assert runtime semantic authentication. A duplicate streaming emitter/comparator is not required just to return this unverified internal state. Final acceptance still requires actual-output parse/resolve/admission under the exact policy and carried O, strict whole-Project equality with E scratch reserved, a resolved temporal parser accounting contract, and an owning accepted result after temporary syntax drops. Those requirements cannot be substituted by length checks or byte tests. Original E is provenance metadata, not a demonstrated bound on arbitrary faulty emitted syntax. The later verifier must justify its equality bound against both actual operands and cannot rely on an unperformed runtime topology check.