5.9 KiB
Private syntax text producer prerequisite
Source baseline: 8d52dab97c92cc31baae9f20d8c324b55818aa5d.
Selected after independent critique. This prerequisite addresses the named text
timing gap in the carried-phase and emission contracts. It grants no accepted
rewritten-output, public source8, save/history or installation authority.
Scope and mode
Preserve all existing parser entry points, including the explicit carried-phase route, with their existing limits, charge events and diagnostics. Add a separate private fixture-constructible text-producing route. Its actual bundle, carried owner and exact Limits/ProjectLimits come from the existing opaque authority; arbitrary caller-provided baselines and policy widening remain impossible. Zero carried storage still selects this mode explicitly.
The guarantee is limited to the retained syntax String inventory already walked
by mixed/project/accounting.rs, plus these named temporary result strings:
raw-scanner JSON validation, quoted decode slack, consumed UUID spellings and
local producer copies awaiting transfer or drop. Moves do not reserve again.
Each simultaneous owned copy reserves its own logical UTF-8 length. Typed
duplicate-name sets, traversal, parser entry/metadata
producer timing and other previously documented scratch remain separate open
domains. Model conversion, architectural validation, decoder internal scratch,
allocator capacity/overhead and native stack are not represented by these logical
String lengths. Internal Exact reconstruction/formatting and BigInt storage
remain under existing numeric policy, with unchanged work charges; this exclusion
does not cover retained AST String/Word/Reference values or copied syntax names.
No universal heap claim is permitted.
Admission and lifetime
Before every in-scope copy, check the prospective total carried text C plus live producer text and named temporary text against the existing byte ceiling, using checked arithmetic. Failed reservation changes no totals. These are storage counts, never source-byte/token/entry/reference/numeric work charges. Entry and occurrence phase checks retain their existing behavior.
Before the existing quoted String decoder, reserve P, the UTF-8 payload length excluding exactly the two quotes. Valid JSON has decoded length D <= P: ordinary UTF-8 copies equally, simple escapes contract, BMP escapes yield at most three bytes from six, and surrogate pairs yield four from twelve. On success release P-D. This conservative rule may refuse escaped text whose decoded bytes fit; that is intentional only in the new route. No second decoder or exact-number conversion is introduced. Scanner validation reserves inside the shared scan body after token extent discovery and before serde validation, then drops the result before refunding P. Unclosed tokens never invoke that decoder. Refusal may precede malformed-escape classification in the new route; legacy precedence must remain unchanged. No resumable refused scanner state is exposed.
Retained String producers include typed names/references/quoted fields; ordinary header/include/declaration/AST names, quoted text and words; both retained copies of declaration field keys; nested keys; and projected keys/reference names. Static header roles, source slices, literal spans and copied UUID values are not owned text. All successful consumed spellings must drop before refund: ordinary optional IDs, typed identities, and ordinary HistoricalUuid values. The ordinary declaration-kind word must either remain borrowed with unchanged parsing/error behavior or be accounted while live and released. Nested field key handling must account the clone overlap and release its discarded local original, or use a reviewed equivalent move without silently changing duplicate/error semantics. Project and typed duplicate descriptions already refuse before replacement; they do not create a successful overwrite exemption.
Use small scalar state in the existing Budget and narrowly scoped producer hooks. Do not duplicate full policies or introduce owner-sized inline state. A returned String may provisionally count as owned T until its consumer transfers or drops it; temporary decode slack and scanner results stay separately identifiable. Successful syntax return has no outstanding named temporary reservation. Independently reconcile retained T to the existing complete syntax inventory. Resolution seeds C once, transfers T once and retains the established U/M and bounded counting work semantics. Its text walk must independently sum/compare rather than charge T again. Existing routes retain their existing progressive text walk.
Acceptance
- Preserve all prior actual outcomes, public/legacy malformed-token precedence, complete Project/Usage parity and exact carried-phase caps.
- Check raw/escaped Unicode, simple escapes, surrogate pairs, empty strings, malformed escapes and unpaired surrogates. Assert reserve-before-decoder and drop-before-refund ordering through a bounded hook observer where needed.
- Independently derive complete owner and peak counts for real fixtures using one unchanged profile through parse/resolve. Distinguish arithmetic fault injection from real provenance. Include scanner temporary release, all three UUID consumers, ordinary/projected key and reference overlap, nested fields and multi-file accumulation. A final retained count alone is not a peak oracle.
- Verify exact final T, W=0, once-only C/T transfer, original source and desired data unchanged, and no accepted-output/extraction route.
- Run new focused cases, the unchanged full library disposition, strict core all-target Clippy and format comparison. Investigate stack regressions and measure relevant changed prologues; do not enlarge existing worker stacks.
Later work still needs entry/metadata producer timing and a finite decision on remaining scratch, actual-output verification, justified equality work and an owning accepted-result transition. This prerequisite does not waive them.