Public mixed read: independent acceptance review

Read-only review of selected harness/analysis-public-read-contract-20260925.md, its IMPLEMENTATION-MAP/CRITIQUE, and immutable implementation baseline 7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd. No source edit, compiler, executable or network operation. This is a proposed evaluator contract, not public-API acceptance.

Disposition and concrete diagnostic correction

The selected language::check_mixed_bundle / opaque non-Clone CheckedMixed<'_> is a coherent bounded read capability. Retaining the actual resolved owner and borrowing the complete bundle preserves existing authority without inventing an editable index or output ownership. No fundamental design blocker found. Production wiring and non-test behavior still require actual verification.

One source-backed correction to the implementation map's suggested78/77 oracle is necessary. mixed.rs:345–358 checks budget.index_bytes(total_source_bytes) before Traversal::new. budget.rs:310–313 emits Source8 index/output byte limit exceeded.; mixed.rs:78 maps its start through ordinary_error to code invalid_source. Thus E at caller77 returns main.arcadia, span0..1, line1 column1, Error severity, no object/field/related locations, exactly that message. It does not reach Traversal's later source_limit branch. Parent explicitly selected preserving this existing mapping, not a new error taxonomy. Distinguish parser one-character transport from full traversal/resolver spans.

Existing semantics that must actually cross the production seam

mixed.rs:239–260 checks typed declaration identity and each calculation parameter identity after parsing; missing parameter ID reports the owning declaration start, not an invented exact absent-ID span. language.rs:1291+ refuses omitted project/ordinary IDs at the parser's current token. Test each class separately with all earlier required IDs present.
mixed.rs:283–288 derives source8 Limits from only caller source bytes and step references, with remaining ParseLimits fields UNLIMITED. Therefore internal entries are262144, bytes=min(caller,64MiB), tokens=min(bytes,1048576), references=min(caller,500000), frames256 and numeric work50000000. Caller max_records remains a separate model-admission control, not syntax-entry capacity. Preserve all other original ProjectLimits fields for traversal/model admission.
carried::parse_entry_producers invokes parse_impl with Some(guard),true,true. The new constructor must select an actual borrowed guard with zero carry, not None, a fake pending output or a separately supplied policy. Zero carry excludes caller-owned source bytes from carried storage; input-byte admission and text/entry producer accounting remain active.
Traversal::new validates canonical paths, file counts and case collisions; next()/finish() enforce include existence/cycles/depth and reject detached supplied files. Root depth is0; includes advance depth by1. Duplicate edges count even if a file is visited only once. finish() attributes unreachable-file refusal to the detached path with default span. Do not silently filter the supplied map.
project.rs:596–665 maps actual validation issues in their existing order, reserves mapped diagnostics, rejects any Error issue without returning a successful owner, and retains complete model/warnings/syntax/storage. Warning columns count Unicode scalars, while spans count UTF-8 bytes. Existing fallback to whole owning declaration remains intentional when a validation field has no authored field span.

Non-test complete-model and warning fixtures

Use a real oa-core/tests/public_mixed_read.rs-style integration target importing only public API/model types. Cargo integration tests link the normal non-cfg(test) library; no #[path] access to private modules, public fixture constructor, writer-generated expected model or parser-produced expected Project. A small integration support module may transcribe already independently authored literals and whole model constructors.

Rich OA and SA three-file models. Reuse the literal content and independent model construction of mixed/project/tests.rs::rich_bundle / rich_model, not its accepted() parser helper. This includes ordinary Work and diagram/node references to typed property, property subject back to ordinary Work, calculations f/g across files, nested calls with reordered x/y arguments, and scoped parameter UUIDs reused across different owners (including a UUID equal to the global project UUID). Expected expressions must be constructed by semantic parameter IDs, not textual argument order. Compare the entire Project, all maps/body fields/IDs, and all warnings, not just definitions or named objects. Keep explicit IDs in every class.
Nested ordinary ownership. Add a small authored nested counterpart, or transplant a proven nested ordinary fixture without reconstructing expectations from its parse: OA entity→actor and SA system→component with fixed IDs. Expected parent is explicit in the independent model while source uses nesting. Compare the complete Project. Keep this separate if nesting would alter the rich Work warning set; do not accidentally remove a leaf warning by adding a Work child.
Unicode/CRLF attribution. Apply a literal Unicode comment and CRLF variant with expected model unchanged, then independently count bytes/scalars. Existing small source arcadia 8;\r\nproject p "港🌊" id "00000000-0000-0000-0000-000000000001" { oa_activity w "Work" id "00000000-0000-0000-0000-000000000002" {} }\r\n has Work span76..141, line2,column60. This is a useful separate exact warning fixture rather than guessing offsets after a broad rich rewrite.

For unallocated named Work, pin both warnings in order: unallocated_leaf, fieldSome("allocation"), message Allocate leaf 'Work' to a performer.; then work_without_behavior_context, fieldNone, message Include this leaf activity/function in a process/chain or scenario through a work action or exchange occurrence. Both Warning severity, object UUID suffix2, empty related locations, same actual whole Work declaration span/path/line/column. This avoids the prior false empty-warning and one-warning assumptions. Any added historical trace must be deliberately authored with independently checked endpoints; do not assume a reused example contains traces. Historical tests can remain separate if required rather than make the primary rich fixture unwieldy.

Before every success or error call, retain a complete clone of the literal SourceBundle (or an independently saved raw byte map), and compare it afterward. Assert exact entry string, key set and every UTF-8 string including comments/newlines; no generated IDs, migrated header or stabilization. For successful result, inspect project/warnings while result is alive; drop it explicitly before testing later source mutability. A later ability to clone the public Project does not grant verified save authority.

Finite public policy oracles

E is exactly arcadia 8;\nproject p "Project" id "00000000-0000-0000-0000-000000000001" {\n\n}\n in main.arcadia:78UTF-8 bytes, whole Project with fixed UUID1/nameProject/aliasp and all maps empty, no warnings. With other policy roomy,78 admits source and the known existing zero-carry resolver/storage peaks fit;77 fails the initial byte check with the exact diagnostic above. Its zero-carry text peak44/43 is not reachable through public source-byte policy because the78-byte input fails first. Owned-output152/151 and warning161/160 caps are also not public borrowed-zero examples. Do not expose a profile knob merely to reproduce them.

H three-file include chain is independently authored:

main.arcadia = "arcadia 8;\nproject p \"Project\" id \"00000000-0000-0000-0000-000000000001\" {\ninclude \"part.arcadia\";\n}\n"
part.arcadia = "include \"last.arcadia\";\r\n"
last.arcadia = "//é\r\n"

Lengths101/25/6 total132; same complete empty Project as E, no warnings. Use roomy model/storage limits while varying only one public field:

Boundary	Exact intended observation
Source132/131	132 permits complete input;131 fails initial budget byte check, main0..1,line1col1, invalid_source/index-output-byte message.
Files3/2	3 fits;2 fails Traversal at main0..0,line1col1, project_limit, `Source project exceeds 2 files.`
Include depth2/1	2 fits root0→part1→last2;1 fails at part's include span0..23,line1col1, project_limit, `Include depth exceeds 1.`
Include edges2/1	2 fits;1 fails earlier mixed parser include counter in part, span0..1,line1col1, project_limit, `Include graph exceeds 1 edges.` It is not the later full-span Traversal edge diagnostic.
Detached file	With roomy limits, add syntactically valid unreachable file: unreachable_file on that file, default0..0,line1col1, `Supplied source file is not reachable from the entry file.`

Invalid paths/case collisions/missing files/cycles should similarly use tiny independent fixtures so upstream file/byte failures cannot mask the intended branch. For a cycle, all files/IDs and syntax must otherwise be valid; assert referring include location and actual cycle category. Distinguish source grammar prechecks from final semantic model limits: small max_records may fail while counting declarations before resolution. A final-model-specific test needs a known nested model record/ordered-step contribution that is not exhausted by declaration prechecks. Reuse existing independently counted diagram/node or ordered-flow cases; pin the full expected model and count definition first. Do not call a declaration refusal final-model admission evidence. Reference-bearing typed fixtures need enough model step allowance to isolate the intended earliest reference branch, with an independently counted authored reference total; an empty E/H fixture cannot prove positive reference enforcement.

Internal bridge observation should invoke the same constructor used by the exported API, observe borrowed-zero guard + both producer metadata options and every derived limit, then resolve with that same policy. Deliberately small but sufficient caller max_records distinguishes262144 internal entry cap from model records. Keep existing discriminatory producer tests unchanged. Observation is wiring evidence, not an external public producer-cap failure or all-heap guarantee.

Negative and compile-time authority tests

Remove exactly one project ID, one ordinary declaration ID, one typed declaration ID and one parameter ID from otherwise valid literals in separate cases. Require expected public-facing ID requirement message and source location; do not rely only on Err. Preserve parent-selected existing code/span transport. Add schema3/7/9 refusal with valid remaining syntax, unresolved typed global ref, duplicate global alias/UUID, duplicate scoped parameter, wrong-kind ref, malformed syntax and long ordinary analysis-constructor refusal. Strongly distinguish valid scoped-ID reuse from invalid duplicates within one owner. Success controls for each base fixture prevent malformed test setup from manufacturing negative results. Compare original bytes for every refusal.

Compile-fail documentation must force a later use of the result, otherwise nonlexical lifetimes may legitimately end its source borrow before mutation. Cover moving a CheckedMixed out of a scope containing its source, and mutating bundle.files while calling checked.project()/warnings() afterward. Use only real public imports and a valid fixture helper mirrored by a positive compiling usage example; compile_fail alone would pass for a misspelled API or unrelated error. Also verify no public fields/constructor/into_project/index or Clone implementation is accidentally exposed; no mutable accessor. Avoid additional compile-fail infrastructure if ordinary rustdoc examples suffice.

Gate scope

Run actual non-test integration consumer plus core library, relevant ordinary source integrations and required stack controls, doctests, strict all-target Clippy and format disposition. Production Parser layout and mixed hook cfg changes mean previously successful cfg(test) parsing cannot qualify ordinary non-test callers. Preserve failed runs and investigate concrete changes without increasing stack or budgets. Reuse old runtime evidence only for demonstrably unchanged component inputs.

This contract promises a Rust complete-bundle API, not CLI/discovery/desktop/server support. Existing CLI still discovers and compiles ordinary editable source before returning Check; no CLI feature should be claimed from this API. Preserve depth64/typed depth128 policies, DEPTH_128_VALIDATED=false, prior full-pipeline stack limitation and user-deferred Linux work. No broader all-heap instrumentation or new public error taxonomy is needed for this slice.

13 KiB Raw Blame History Unescape Escape