3.4 KiB
Private retained-entry producer prerequisite
Base 97a8703adc75467a7f8e75f5c6cb00ca542b707c; implements the accepted
harness/analysis-entry-producer-contract-20260925.md in the parent source tree.
This is fixture-only phase/producer evidence, not emitted-output admission.
The explicit entry route also enables text producers and derives C and exact policy from the existing carried guard. Budget adds only optional scalar C/M. Existing legacy, carried-phase and text-only entry paths retain their checkpoints. U keeps its original event sites and work-limit precedence; prospective aggregate checks latch without changing totals. F is installed before traversal. Private State helpers reserve unique value-end keys and lexical owner occurrences before mutation. Successful grammar events count projection slots with checked addition. The new route reserves token-end slots and projection together, without the old borrowed-work counting Vec. A scalar quota checks each projected envelope, field and actual value before growth. Synthetic bodies remain included in seven. Per-file actual map/owner lengths and final independent metadata reconcile M; resolver C then U+M transfer and text reconciliation are unchanged.
Six tests in mixed::carried::entry_producer cover independent literal E and H
syntax caps 13/12 and 25/24 separately from resolver 17/16 and 29/28, owner/value
prefix refusals 4/7, and the 344-byte nested syntax-only fixture (U13, M89, P30,
C1; 103/102). They check node/element envelopes, nested positions and owner order,
quota underflow/leftover, direct unchanged collections on refusal and repeated
map-key replacement. Labeled arithmetic controls exercise overflow, sticky-first
failure, prospective U and work-limit precedence. Whole OA/SA Project, warnings,
Usage, numeric work and retained totals are compared with text-only under actual
and explicit zero guards. Old-route diagnostics and original bytes are checked.
All byte policies are roomy 4096 so earlier text limits do not mask entry tests.
Source review identified a possible internal overflow call overwriting an already latched error. The helper now returns the first failure; a direct fault control checks that behavior. Repeated map keys now perform a zero-delta reservation before replacement, preserving a latched refusal without modifying the map; a direct control checks that branch too. These were corrected before compilation, not a runtime bug observation. Test review also caught that the independent inventory walker adds its own existing scratch slots: exact-cap ordinary syntax controls remain at 29/37/103, while a separate roomy owner of the same literal runs that walk. No live policy is widened and no exact-cap resolver success is implied. No prior tests, stack sizes, policies, inherited failure dispositions or unrelated formatting are changed. Only touched Rust files were directly formatted with skip_children. Parent owns compiler, full disposition, Clippy, format and prologue/stack acceptance; no runtime result is claimed here.
Allocator overhead, token storage under its existing token ceiling, delimiter and other work stacks, numeric/decoder internals and model/validator heap remain outside this retained metric. The extra shared projector wrapper and scalar Budget/State fields require measured parent stack checks; no heap indirection or larger stack is introduced. Final output acceptance remains a separate task.