Independent carried-phase oracle

Source inspected: 18073a6f2eabce83fc83997f094e331eec835a16, before carried implementation. Accepted scope: harness/analysis-carried-phase-contract-20260925.md. Expectations below are literal source/grammar/accounting counts, not parser output, measured thresholds or generated model expectations. No Cargo or application evaluator was run.

Exact fixtures

All strings below use Rust escape notation; no BOM. entry = "main.arcadia".

E, existing project::tests::single(""), has one file:

main.arcadia = "arcadia 8;\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\n\n}\n"

H, a three-file include chain, has these exact files:

main.arcadia = "arcadia 8;\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\ninclude \"part.arcadia\";\n}\n"
part.arcadia = "include \"last.arcadia\";\r\n"
last.arcadia = "//\u{00e9}\r\n"

The last source contains actual U+00E9, not literal backslash escape characters. Its UTF-8 length is 6: two slashes, two bytes for U+00E9, CR and LF. Traversal order is main, part, last; retained canonical file order is last, main, part. Both fixtures describe only the same project: schema8, UUID suffix1, alias p, name Project, empty description and all model maps empty. No warnings, expressions or lower occurrences are expected.

Quantity	E	H
File/map entry count F	1	3
Individual source byte lengths	78	101,25,6
Total source work bytes	78	132
Owned path-key bytes	12	36
Owned entry-path bytes	12	12
Actual retained owner C entries	1	3
Actual retained owner C occurrences	0	0
Actual retained owner C text	102	180

There is one entry-path allocation in addition to each map key. Source bytes are already included in C.text; parsing charges their work once but does not add them again to live text. No arbitrary prior-owner storage is counted by this minimal fixture.

Parser arithmetic

E significant tokens are exactly arcadia, 8, ;, project, p, quoted name, id, quoted UUID, {, }: ten. Nine whitespace runs give nineteen raw scanner events. The project charges one syntax entry. There are no value ends, ordinary position slots, lexical owners, references, frames or Exact operations. M is one file reference plus ten significant-token metadata slots =11; U=1.

H main has the same ten significant tokens plus include/string/semicolon =13. It has eleven whitespace runs, hence24 raw scanner events. Part has3 significant tokens and2 whitespace runs, hence5 raw events. Last has one comment (including CR) and one LF whitespace event, hence2 raw events and0 significant tokens. Total scanner events31. The project and two includes charge U=3. All value-end/ordinary-position/lexical-owner contributions remain zero.

H checkpoint	U	M	Owned C.entries+U+M	Borrowed-zero U+M
Before traversal	0	3	6	3
Main preprojection	2	3+13=16	21	18
Part preprojection	3	16+3=19	25	22
Last preprojection/final syntax	3	19+0=19	25	22

E initial owned file sum is2; preprojection/final sum13. Successful new-snapshot Usage is independent of C: E (bytes78,tokens19,entries1,references0,deepest_frame0), H (bytes132,tokens31,entries3,references0,deepest_frame0), numeric work0 for each.

Discriminating entry-cap cases, with other limits generous:

E owned: cap13 returns syntax; cap12 refuses the preprojection sum even though C1, U1 and M11 each fit separately. Do not call cap13 a complete resolve pass.
H owned: cap25 returns syntax; cap24 refuses at part, after main's21 passed. Cap20 refuses at main. These catch missing prior-file U/M and incorrect file attribution.
E borrowed-zero carried: cap12 returns syntax; cap11 refuses preprojection. Legacy cap11 must still return syntax, then fail initial resolver U+M admission12. This distinguishes explicit carried mode from a numeric C == 0 bypass and from inadvertently changing legacy timing.
Initial owned C+F: E cap1 refuses sum2; H cap5 refuses sum6. Their C values separately fit. Cap2/E or cap6/H clears only the initial checkpoint, not the full parser. If an observable ordering sentinel is needed, use E with test-only ProjectLimits.max_files=0: cap1 gets the initial lowering refusal, cap2 reaches traversal's project_limit refusal. Do not describe that deliberately invalid-policy fixture as an admitted positive owner.

Resolve and text arithmetic

Syntax accounting retains U+M entries and T text. E T=alias1+name7=8. H T=8+two include strings12 each=32. These fixtures have no accounting work-stack items: there are no declaration positions, AST values or expressions to visit. The project catalog temporarily retains alias map1 entry/text1, owner map1 entry, and lower tables2 entries/text1. Its peak adds4 entries/2 text. All four entries and both alias copies are subsequently released; no mapped warnings add storage.

Exact storage	E zero	E owned	H zero	H owned
Syntax/final retained entries	12	13	22	25
Maximum resolver entries	16	17	26	29
Syntax/final retained text	8	110	32	212
Maximum resolver text	10	112	34	214
Final lower occurrences	0	0	0	0

Thus independent combined full-path pairs are E (entries17,bytes112) fit versus entries16 or bytes111 refusal; H (entries29,bytes214) fit versus entries28 or bytes213 refusal. Each failed coordinate is varied independently with the other sufficient. In both entry failures parser admission passes; the failure is the project lower-table catalog reservation. A zero-C complete resolve fits at the failed owned cap, so carry participation is directly discriminated. Successful final live slots must equal E (13,0,110) and H (25,0,212), exactly normal base plus C once; this catches seeding zero, doubling C, or retaining parser checks as extra reservations.

Text timing can be tested separately: E owned bytes110 admits syntax accounting but later catalog needs112; bytes109 admits C102 and original source78 and completes parsing, then fails while accounting project name (C102+alias1+name7=110). Bytes102/101 tests C text admission at fit/fail;102 is only admission-fit, not full-resolution-fit. H owned bytes212 admits syntax text but catalog needs214; bytes211 fails when part's include text takes180+8+24=212. Canonical ordering means part's include text12 is counted after main's header/include, not before. Both quoted names and paths have already been decoded by the time syntax text accounting refuses. These are not before-decoding guarantees.

Exact diagnostic expectations

Preserve existing transport distinction: parser ordinary_error then located converts the error's starting offset to a one-character span; resolver Failure::typed explicitly restores the full typed span.

Parser aggregate/file-slot/C-admission errors at default span become main.arcadia, span0..1, line1 column1, code invalid_source, no related locations. H cap24 preprojection error is part.arcadia, span0..1, line1 column1; H cap20 is main0..1.
Entry resource message: Source8 lowering entry limit exceeded. Text resource message: Source8 index/output byte limit exceeded.
E legacy cap11 syntax succeeds, then resolve's initial U+M error is main 0..0, line1 column1, not parser0..1.
Project catalog entry/text refusals above are main 11..73, line2 column1, code invalid_source, same resource message. The header starts at project offset11 and ends immediately before { offset73.
E bytes109 syntax-text refusal uses that header11..73. H bytes211 syntax-text refusal is part.arcadia, include span 0..23, line1 column1 (its include is the final12-byte addition).
H source include spans are main75..98 and part0..23. They are useful independent include-depth/edge attribution controls.

Policy and ownership controls

Use all six distinct captured Limits values and all ProjectLimits fields, compare exact policy snapshots, and separately exercise real tightened work limits. Do not reconstruct a default profile or subtract C from entry/text limits as a replacement policy.

H borrowed-zero bytes132 passes source work; bytes131 refuses complete-source precheck, main0..1. H owned cannot isolate the132-byte source boundary because its C.text180 is already larger; use borrowed mode honestly.
E raw-token19 fits and18 refuses final newline; H31 fits and30 refuses last-file LF at byte5, giving last.arcadia span5..6, line1 column5. C does not consume token events.
H max_files3 versus2 and include depth2 versus1 test retained file/depth policy; max_include_edges2 versus1 tests the second include. Preserve normal traversal/parser diagnostic codes rather than replacing them with storage errors. Keep entry and byte storage limits large enough to reach those checks.
E/H have zero new references, frames and numeric work. Exact snapshot equality can detect widened fields, but these fixtures cannot behaviorally prove positive reference/frame/numeric enforcement. Reuse the established admitted reference/nested-value/Exact fixtures with tightened captured policies for those tests; do not pretend empty fixtures exercise them. A preceding witness's nonzero Usage must not be copied into this snapshot.
Every retained positive owner owns exactly the actual bundle counted above, remains alive through returned syntax/resolved guards, and cannot be swapped for an unrelated bundle. Failure returns only diagnostics. Successful owner provenance has occurrence C=0; nonzero occurrence and unreachable arithmetic-overflow injections are explicitly fault-injection tests, not fixture storage or successful constructor evidence.

No new implementation was inspected or executed. This oracle establishes expected phase behavior only; it neither accepts an emitter, grants editing/install authority, claims universal small-stack behavior, nor closes predecessor before-growth obligations.

9.9 KiB Raw Blame History