5.4 KiB
Actual emitted-output acceptance — working proposal
2026-09-25, parent read-only design based on source97a8703 and the entry-producer contract; entry implementation has not yet passed gates. This is neither selected contract nor permission to activate public source8. No next implementation claim.
The useful next outcome is a single owning accepted output after parsing the actual complete emitted bytes with inherited policy and carried output storage, resolving/admitting them and comparing the entire Project to desired intent. Do not insert another unneeded fixture-only milestone after the retained producer requirements pass. Remaining scratch-domain precision still needs explicit decision and independent critique; see DOMAIN-DECISION-CRITIQUE.md when ready.
Narrow authority/lifetime candidate
Current private emission::PendingRename contains actual SourceBundle, exact Limits/ProjectLimits, reserved output Slots, original E and immutable desired Project borrow. Its only non-test constructor is consumed emission. Existing carried::CarriedInput currently accepts borrowed or fixture RetainedSnapshot.
Candidate A: add a named CarriedInput::from_pending(&PendingRename), with access only through read-only sealed pending views. It must derive all bundle, exact policy and retained slots from that same pending owner, accepting no loose bundle/profile/Slots. Backing can store the existing bundle/policy plus a shared reference to the pending retained Slots; guard needs only that reference after policy transfers to Budget. The function's borrow lifetime keeps the entire pending owner unavailable for mutation or consumption during verification. This avoids introducing desired's second lifetime into every parser owner. Prove this with actual Rust type checks; do not assume a reference to counters alone is sufficient authority if construction can be separated from the owner.
Candidate B: move owned snapshot storage into a shared RetainedSnapshot wrapper used by PendingRename, then reference it directly. This may simplify backing but must avoid an unrestricted new(bundle,slots,policy) constructor or unnecessarily coupling parser construction to emitter internals. Compare actual code size and representation before choosing. No generic trait/callback allocator framework.
A consuming PendingRename::verify method borrows itself for the strong combined text/entry parse; every result remains local until success. Consume syntax through project::resolve under the same carried guard, so complete model admission is the existing one. After equality and bounded validation, drop resolved syntax, model/catalogs and guards explicitly, then move SourceBundle into a narrow owning accepted result. Failure returns located diagnostics and drops pending output; no usable partial bundle or accepted token escapes. An owned accepted bundle is not a self-referential parsed witness. Repeated retained-source editing and actual filesystem/history installation remain distinct work.
Whole equality and scratch
Reuse complete Project PartialEq, including established signed-zero semantics; do not reuse rename::same_project, which intentionally exempts names. The comparator's left operand must be the freshly resolved actual output model. Use that resolver's actual raw-expression-site count E_actual as the conservative equality frontier bound, reserving it against its live ledger before comparison and releasing after equality returns. Original E remains provenance only and cannot bound faulty emitted output. Existing planner proof covers Expr's iterative frontier only when every actual left-model Expr root is represented in the source expression arena; re-audit this reachability for full Project equality (including opaque historical carriers) before selecting E_actual. Original scalar count is not proof of actual output topology. No additional counting traversal or cloning desired model should be introduced without its own bound.
Reject malformed bytes, model-invalid bytes, admissible-but-wrong aliases and admissible-but-wrong non-name semantics. Error reporting must not recursively format arbitrary models. Exact input/output policies survive; new parser Usage is separate snapshot work. Output C remains live through syntax, resolver and equality and must never be reset to zero or added twice.
Required finite acceptance before implementation
Reuse published emitter exact OA/SA/all-file/Unicode/CRLF maps as independent byte expectations. Construct at least one actual emitted owner whose inherited profile admits original parse/index/plan/emission and then passes verification, plus cap-minus-one refusal at the intended later stage; do not tighten a live owner after admission. Fake/mutated pending bytes are labeled corruption controls. Original empty/project rename may have a new combined producer peak greater than the emitter's former114-byte oracle: recompute the whole pipeline honestly.
Test wrong-but-admissible output, malformed output, exact policies, complete source/target immutability and scope/lifetime of returned ownership. Wide/deep actual output versus target-only shape mismatch must establish equality's chosen frontier bound. New tests do not replace existing public/legacy/fmt dispositions, stack controls or the separately unrerun older full-pipeline setup limitation. Full parsed-output acceptance remains private until a separate public integration contract reconciles all16 schema8 failures and complete graphical/source behavior.