96 lines
5.9 KiB
Markdown
96 lines
5.9 KiB
Markdown
# Private syntax text producer prerequisite
|
|
|
|
Source baseline: `8d52dab97c92cc31baae9f20d8c324b55818aa5d`.
|
|
Selected after independent critique. This prerequisite addresses the named text
|
|
timing gap in the carried-phase and emission contracts. It grants no accepted
|
|
rewritten-output, public source8, save/history or installation authority.
|
|
|
|
## Scope and mode
|
|
|
|
Preserve all existing parser entry points, including the explicit carried-phase
|
|
route, with their existing limits, charge events and diagnostics. Add a separate
|
|
private fixture-constructible text-producing route. Its actual bundle, carried
|
|
owner and exact Limits/ProjectLimits come from the existing opaque authority;
|
|
arbitrary caller-provided baselines and policy widening remain impossible.
|
|
Zero carried storage still selects this mode explicitly.
|
|
|
|
The guarantee is limited to the retained syntax String inventory already walked
|
|
by `mixed/project/accounting.rs`, plus these named temporary result strings:
|
|
raw-scanner JSON validation, quoted decode slack, consumed UUID spellings and
|
|
local producer copies awaiting transfer or drop. Moves do not reserve again.
|
|
Each simultaneous owned copy reserves its own logical UTF-8 length. Typed
|
|
duplicate-name sets, traversal, parser entry/metadata
|
|
producer timing and other previously documented scratch remain separate open
|
|
domains. Model conversion, architectural validation, decoder internal scratch,
|
|
allocator capacity/overhead and native stack are not represented by these logical
|
|
String lengths. Internal Exact reconstruction/formatting and BigInt storage
|
|
remain under existing numeric policy, with unchanged work charges; this exclusion
|
|
does not cover retained AST String/Word/Reference values or copied syntax names.
|
|
No universal heap claim is permitted.
|
|
|
|
## Admission and lifetime
|
|
|
|
Before every in-scope copy, check the prospective total carried text C plus
|
|
live producer text and named temporary text against the existing byte ceiling,
|
|
using checked arithmetic. Failed reservation changes no totals. These are storage
|
|
counts, never source-byte/token/entry/reference/numeric work charges. Entry and
|
|
occurrence phase checks retain their existing behavior.
|
|
|
|
Before the existing quoted String decoder, reserve P, the UTF-8 payload length
|
|
excluding exactly the two quotes. Valid JSON has decoded length D <= P: ordinary
|
|
UTF-8 copies equally, simple escapes contract, BMP escapes yield at most three
|
|
bytes from six, and surrogate pairs yield four from twelve. On success release
|
|
P-D. This conservative rule may refuse escaped text whose decoded bytes fit;
|
|
that is intentional only in the new route. No second decoder or exact-number
|
|
conversion is introduced. Scanner validation reserves inside the shared scan
|
|
body after token extent discovery and before serde validation, then drops the
|
|
result before refunding P. Unclosed tokens never invoke that decoder. Refusal
|
|
may precede malformed-escape classification in the new route; legacy precedence
|
|
must remain unchanged. No resumable refused scanner state is exposed.
|
|
|
|
Retained String producers include typed names/references/quoted fields; ordinary
|
|
header/include/declaration/AST names, quoted text and words; both retained copies
|
|
of declaration field keys; nested keys; and projected keys/reference names.
|
|
Static header roles, source slices, literal spans and copied UUID values are not
|
|
owned text. All successful consumed spellings must drop before refund: ordinary
|
|
optional IDs, typed identities, and ordinary HistoricalUuid values. The ordinary
|
|
declaration-kind word must either remain borrowed with unchanged parsing/error
|
|
behavior or be accounted while live and released. Nested field key handling
|
|
must account the clone overlap and release its discarded local original, or use
|
|
a reviewed equivalent move without silently changing duplicate/error semantics.
|
|
Project and typed duplicate descriptions already refuse before replacement;
|
|
they do not create a successful overwrite exemption.
|
|
|
|
Use small scalar state in the existing Budget and narrowly scoped producer hooks.
|
|
Do not duplicate full policies or introduce owner-sized inline state. A returned
|
|
String may provisionally count as owned T until its consumer transfers or drops
|
|
it; temporary decode slack and scanner results stay separately identifiable.
|
|
Successful
|
|
syntax return has no outstanding named temporary reservation. Independently
|
|
reconcile retained T to the existing complete syntax inventory. Resolution seeds
|
|
C once, transfers T once and retains the established U/M and bounded counting
|
|
work semantics. Its text walk must independently sum/compare rather than charge
|
|
T again. Existing routes retain their existing progressive text walk.
|
|
|
|
## Acceptance
|
|
|
|
- Preserve all prior actual outcomes, public/legacy malformed-token precedence,
|
|
complete Project/Usage parity and exact carried-phase caps.
|
|
- Check raw/escaped Unicode, simple escapes, surrogate pairs, empty strings,
|
|
malformed escapes and unpaired surrogates. Assert reserve-before-decoder and
|
|
drop-before-refund ordering through a bounded hook observer where needed.
|
|
- Independently derive complete owner and peak counts for real fixtures using one
|
|
unchanged profile through parse/resolve. Distinguish arithmetic fault injection
|
|
from real provenance. Include scanner temporary release, all three UUID
|
|
consumers, ordinary/projected key and reference overlap, nested fields and
|
|
multi-file accumulation. A final retained count alone is not a peak oracle.
|
|
- Verify exact final T, W=0, once-only C/T transfer, original source and desired
|
|
data unchanged, and no accepted-output/extraction route.
|
|
- Run new focused cases, the unchanged full library disposition, strict core
|
|
all-target Clippy and format comparison. Investigate stack regressions and
|
|
measure relevant changed prologues; do not enlarge existing worker stacks.
|
|
|
|
Later work still needs entry/metadata producer timing and a finite decision on
|
|
remaining scratch, actual-output verification, justified equality work and an
|
|
owning accepted-result transition. This prerequisite does not waive them.
|