ARCADIA-Studio/harness/analysis-entry-producer-contract-20260925.md

Private retained-entry producer prerequisite

Baseline 97a8703adc75467a7f8e75f5c6cb00ca542b707c. This selected contract strengthens the timing of the existing logical entry metric. It does not grant accepted-output, public source8 or save/history authority. Source/evidence remain local until the Gitea storage publication blocker is resolved.

Metric and authority

Add one explicit fixture route enabling both text and entry producers, using the existing opaque CarriedInput and exact inherited policy. Preserve legacy, carried-phase and text-only routes and their diagnostic timing. C comes from the actual carried guard, including an explicitly selected zero guard.

U remains exactly Budget.usage.entries, the existing cumulative syntax events. M remains F supplied file records + one significant-token-end subtotal + unique ordinary value-end keys + ordinary lexical-owner occurrences + projected slots. Projected slots remain seven per ordinary declaration (including its synthetic body and conservative header envelope), one per field, one per actual Ast value. Node headers also retain the seven envelope. Dropped token/value-end structures keep their conservative subtotal through syntax return. Usage never includes C, M or quota consumption, and significant tokens do not gain a second M charge.

Before selected growth check checked C.entries + U + M + delta against the exact entry ceiling. A failed check changes no U/M total. Use only small scalar optional Budget state; do not duplicate policy or create another owning wrapper. Preserve current byte/guard checks, then atomically validate/install C and M=F before Traversal construction. F is transferred, not charged again, when file records move between containers.

Producer and reconciliation rules

• Budget::entry preserves its existing syntax-work check first; in the new mode check the prospective aggregate before incrementing U or returning to callers. Existing typed/ordinary event sites remain unchanged.
• Encapsulate value-end key-presence check, reservation and insertion in one State helper. Charge only a new key. Encapsulate lexical-owner reservation and push likewise; charge occurrences, not distinct UUIDs. Hide unchecked mutable metadata access from the ordinary parser.
• Count pending projection with checked scalar grammar hooks: seven per ordinary declaration, one per successfully parsed field and one per successful value. Nested values/fields naturally contribute. Project/include/description do not call these hooks; duplicate fields fail the entire parse. The synthetic body is already in seven, and adds no value event.
• At projection boundary atomically reserve token count plus pending projection into M before ends/header/field/value construction. The stronger route must not call the old unmetered borrowed-work Vec counting pass. Other routes keep that existing path.
• A scalar prepaid quota is consumed before projector growth: seven before a declaration/header envelope, one before each field, one before each actual value (before recursive children). It neither recharges nor refunds M. Require zero after projection. Under/over quota is an internal invariant failure, never a successful witness with corrected/subtracted counts.
• After each file compare reserved map/owner counts with actual lengths and M delta with checked token/owner/map/projected inventory. At syntax completion compare total M with the independently accumulated metadata field. Keep the existing once-only C then U+M resolver ledger transfer; text reconciliation remains unchanged. Never seed a combined total and add syntax a second time.

Rejection behavior

New aggregate ceiling refusal uses Source8 lowering entry limit exceeded. Overflow uses Source8 producer entry size overflow. Both latch in the new entry mode, leave totals unchanged and propagate immediately. Legacy phase checks keep their existing nonlatching semantics. U-only failure retains its existing precedence and message. Invariant mismatches return an explicit error; they cannot silently repair a count or produce an accepted result.

Attribute U to its existing event span; owner to the original declaration start; value-end to the completed Ast's start/end; file and complete projection reservation to Span::default in the current file. Grammar counter overflow uses its corresponding declaration/field/value span. Ordinary diagnostic transport continues to use the existing one-byte start representation. Tests distinguish these actual seam diagnostics from later phase or resolver refusal.

Acceptance and exclusions

Real E: C1/U1/M11 gives syntax13/12; full resolver17/16 is a separate boundary. Real three-file chain: C3/U3/M19 gives syntax25/24, separate resolver29/28. Use sufficiently large unchanged text policies (at least E146 and chain358), so earlier text limits cannot preempt the entry assertion. First ordinary owner refuses at prefix cap4; first description value-end refuses at prefix cap7. Neither next integer is claimed to admit the complete document. Review the reserve-plus-mutate helpers and test unchanged collections on refusal directly.

Independently author a nested record/array/reference/historical UUID fixture and node/element envelopes, with literal counts and spans fixed before runtime. Cover repeated map keys, quota underflow/leftover, overflow and latched refusal as labeled internal controls. Verify actual-owner and explicit C0 routes, whole OA/SA and multi-file Project/Usage/numeric parity against text-only, source conservation, once-only transfer and unchanged old caps/errors. Run new focused cases, full existing disposition, strict core Clippy and format comparison; inspect changed Budget/State/projector prologues and all old small-stack controls. Do not enlarge stacks, loosen tests or add a heap wrapper to hide regressions.

This retained metric does not bound allocator capacity/node overhead, file-table physical transfer overlap, significant-token storage beyond its existing token bound, traversal/open-declaration/delimiter/Pratt work stacks, duplicate-name scratch, numeric/decoder internals, model/validator heap or native stack. Those named scratch domains need a later explicit finite decision. Actual emitted-byte verification, justified whole-Project equality work and accepted bundle ownership also remain open. No claim of before-every-allocation or all-heap accounting.