129 lines
8.1 KiB
Markdown
129 lines
8.1 KiB
Markdown
# Private mixed rename emission prerequisite
|
|
|
|
2026-09-25. Selected private prerequisite following bounded design and independent
|
|
ownership/oracle review; implementation and runtime acceptance pending. Source baseline:
|
|
`fa7a980418ef99d772e67c66c28dfa7b5181f875`. This implements the output construction
|
|
and old-owner lifetime portion of the [rename successor](analysis-mixed-rename-plan-contract-20260924.md#mandatory-successor-accepted-rewritten-output).
|
|
It does not implement accepted output, public source8, persistence or history.
|
|
The [carried parser prerequisite](analysis-carried-phase-contract-20260925.md)
|
|
and its remaining before-growth limitations retain their stated scope.
|
|
The [producer inventory](analysis-mixed-emission-design-20260925/NEXT-PRODUCER-HOOKS.md),
|
|
[independent critique](analysis-mixed-emission-design-20260925/NEXT-PRODUCER-CRITIQUE.md),
|
|
[transition proposal](analysis-mixed-emission-design-20260925/EMISSION-TRANSITION-PROPOSAL.md)
|
|
and [contract review with ownership correction](analysis-mixed-emission-design-20260925/EMISSION-CONTRACT-REVIEW.md)
|
|
record candidates and rationale. This selected contract supersedes conflicting
|
|
earlier proposal choices, including the owning enum and runtime byte guard.
|
|
|
|
## Ownership and API
|
|
|
|
Consume the opaque `RenamePlan` and borrow a complete current `SourceBundle`.
|
|
Revalidate current entry, complete file set, paths and all bytes against the
|
|
original snapshot before any copying, including for no-op. Reuse the planner's
|
|
complete physical edit validation; no external edit list, Project or policy may
|
|
replace its authority.
|
|
|
|
If no names changed, return the original `AuthoredMixedProject` unchanged, with
|
|
its actual bundle, policy, work usage, warnings and storage. Allocate no output.
|
|
The changed result owns a complete pending bundle, the exact inherited `Limits`
|
|
and `ProjectLimits`, its verified output storage total O, the desired Project
|
|
borrow and scalar original expression-site count E. It retains no old syntax,
|
|
catalog, warning, index or plan map. Original caller-owned source and desired
|
|
Project remain untouched. This does not claim those external borrows are freed.
|
|
|
|
Keep pending fields private. Expose no bundle extraction, mutation, installation,
|
|
history, save or accepted-result conversion. Tests may inspect fields. No general
|
|
constructor accepting arbitrary bundle/Slots/policy is authorized. The only
|
|
construction path consumes the actual plan after checked emission. Reuse or add
|
|
a sealed carried-snapshot connection only if it accepts this actual pending
|
|
owner, never loose parts; invoking parser verification remains outside this slice.
|
|
|
|
For changed emission in this prerequisite require original legacy syntax
|
|
(`carried == None`). Reject an explicit carried source before output reservation,
|
|
even its borrowed-zero mode. Dropping a source witness only drops its guard; an
|
|
external RetainedSnapshot would remain alive, so claiming only O survived would
|
|
hide C. Future repeated owned editing needs an explicitly consuming owner
|
|
transition or surviving C guard. No-op may preserve any source and its guard
|
|
unchanged, because no old reservation is discarded. This narrow provenance
|
|
restriction is intentional, not a numeric-zero shortcut or a final editing API.
|
|
|
|
Select two explicit consuming methods:
|
|
`into_unchanged(self, current) -> Result<AuthoredMixedProject<'s>, Failure>` and
|
|
`emit_changed_unverified(self, current) -> Result<PendingRename<'t>, Failure>`.
|
|
Both validate current snapshot and complete edits and enforce their branch;
|
|
calling the wrong branch refuses. Callers can select using the existing immutable
|
|
`changed_names().is_empty()` observation. A branch cannot change after that read.
|
|
This separates source and desired lifetimes without boxing, a large common
|
|
owning result enum, generic callback machinery or lint exemptions. Do not
|
|
duplicate full policy inside old syntax owners. Keep all existing stack controls.
|
|
|
|
## Storage and construction
|
|
|
|
Let B be the existing plan owner's live ledger, which already includes both the
|
|
R changed-name entries and M physical-edit entries. Do not add R+M twice.
|
|
Compute the complete final file byte sum S using the existing checked original
|
|
coordinate sizing walk, including untouched files. Then compute
|
|
|
|
```text
|
|
O.entries = original complete file count F
|
|
O.occurrences = 0
|
|
O.text = S + sum(canonical key UTF-8 byte lengths) + entry UTF-8 byte length
|
|
peak during emission = B + O
|
|
```
|
|
|
|
Every addition/subtraction must be checked. Reserve all O against the original
|
|
ledger and exact inherited policy before constructing any output String, copied
|
|
key, entry or map element. Reserving the complete monotone output up front covers
|
|
its partial construction; capacity/allocator overhead remain outside the logical
|
|
metric. Original sources and desired replacement aliases are borrowed during
|
|
copying. No lengths map, copied edit list, temporary complete file or second
|
|
output buffer is needed. Any additional owned container requires explicit scope
|
|
and reservation before growth. Source-size shrinkage does not release old B.
|
|
|
|
Walk canonical files and the sorted edit stream. For each file, append original
|
|
untouched ranges and the exact qualified target's desired alias in original byte
|
|
coordinates, then the tail. Produce one String per file, including untouched
|
|
files; preserve complete paths and entry. Avoid reparsing, decoding, UUID creation,
|
|
normalization and global textual replacement. Validate original UTF-8 boundaries
|
|
and nonoverlap through the existing complete edit validator before construction.
|
|
Check the constructed length against independently computed size before ownership
|
|
transition. Check final complete file count and byte total without a second copy.
|
|
|
|
Capture policy and E as scalars; destroy old plan maps and the complete old source
|
|
owner explicitly before returning the pending owner. O is then the only retained
|
|
in-scope owner from this operation. Failure yields existing located diagnostics
|
|
and drops partial output; no partial owner escapes. Preserve failure ordering:
|
|
stale snapshot, invalid edit map/size, output storage reservation, construction
|
|
consistency; changed carried-source refusal precedes output reservation.
|
|
Arithmetic fault injection must be labeled as such, not successful
|
|
real-world owner provenance.
|
|
|
|
## Verification and remaining boundary
|
|
|
|
Use independent literal original-coordinate maps and expected full bytes for OA
|
|
and SA, simultaneous global/scoped swaps, repeated/reordered labels, cross-file
|
|
references, ordinary categories, Unicode/CRLF and comments. Verify copied untouched
|
|
files and exact entry/keys. No-op must preserve original owner data/pointers, not
|
|
an equivalent reconstructed owner. Corrupt current touched/untouched data, paths,
|
|
entry and file set, and corrupt plan edit locations/targets through test-only
|
|
access; require no result. Reuse valid planner tests where they cover the same
|
|
validator rather than duplicate all cases.
|
|
|
|
Independently hand-count a small real fixture's B and O. Choose exact entry/text
|
|
caps that admit all predecessor phases and refuse cap-minus-one at emission.
|
|
Do not mutate an admitted live ledger or widen policy to manufacture this test.
|
|
Assert final O, original exact policies, desired borrow and E. Include combined
|
|
grow/shrink and unchanged-file sizing. Small-stack emission/drop checks prepare
|
|
parser prerequisites on the normal thread, then move the complete consumed plan
|
|
into the worker; preserve all prior full-pipeline controls and limitations.
|
|
|
|
Independent byte fixtures test the emitter; the pending type does not assert
|
|
runtime semantic authentication. A duplicate streaming emitter/comparator is not
|
|
required just to return this unverified internal state. Final acceptance still
|
|
requires actual-output parse/resolve/admission under the exact policy and carried
|
|
O, strict whole-Project equality with E scratch reserved, a resolved temporal
|
|
parser accounting contract, and an owning accepted result after temporary syntax
|
|
drops. Those requirements cannot be substituted by length checks or byte tests.
|
|
Original E is provenance metadata, not a demonstrated bound on arbitrary faulty
|
|
emitted syntax. The later verifier must justify its equality bound against both
|
|
actual operands and cannot rely on an unperformed runtime topology check.
|