86 lines
5.4 KiB
Markdown
86 lines
5.4 KiB
Markdown
# Actual emitted-output acceptance — working proposal
|
|
|
|
2026-09-25, parent read-only design based on source97a8703 and the entry-producer
|
|
contract; entry implementation has not yet passed gates. This is neither selected
|
|
contract nor permission to activate public source8. No next implementation claim.
|
|
|
|
The useful next outcome is a single owning accepted output after parsing the
|
|
actual complete emitted bytes with inherited policy and carried output storage,
|
|
resolving/admitting them and comparing the entire Project to desired intent.
|
|
Do not insert another unneeded fixture-only milestone after the retained producer
|
|
requirements pass. Remaining scratch-domain precision still needs explicit
|
|
decision and independent critique; see DOMAIN-DECISION-CRITIQUE.md when ready.
|
|
|
|
## Narrow authority/lifetime candidate
|
|
|
|
Current private emission::PendingRename contains actual SourceBundle, exact
|
|
Limits/ProjectLimits, reserved output Slots, original E and immutable desired
|
|
Project borrow. Its only non-test constructor is consumed emission. Existing
|
|
carried::CarriedInput currently accepts borrowed or fixture RetainedSnapshot.
|
|
|
|
Candidate A: add a named CarriedInput::from_pending(&PendingRename), with access
|
|
only through read-only sealed pending views. It must derive all bundle, exact
|
|
policy and retained slots from that same pending owner, accepting no loose
|
|
bundle/profile/Slots. Backing can store the existing bundle/policy plus a shared
|
|
reference to the pending retained Slots; guard needs only that reference after
|
|
policy transfers to Budget. The function's borrow lifetime keeps the entire
|
|
pending owner unavailable for mutation or consumption during verification. This
|
|
avoids introducing desired's second lifetime into every parser owner. Prove this
|
|
with actual Rust type checks; do not assume a reference to counters alone is
|
|
sufficient authority if construction can be separated from the owner.
|
|
|
|
Candidate B: move owned snapshot storage into a shared RetainedSnapshot wrapper
|
|
used by PendingRename, then reference it directly. This may simplify backing but
|
|
must avoid an unrestricted new(bundle,slots,policy) constructor or unnecessarily
|
|
coupling parser construction to emitter internals. Compare actual code size and
|
|
representation before choosing. No generic trait/callback allocator framework.
|
|
|
|
A consuming PendingRename::verify method borrows itself for the strong combined
|
|
text/entry parse; every result remains local until success. Consume syntax through
|
|
project::resolve under the same carried guard, so complete model admission is
|
|
the existing one. After equality and bounded validation, drop resolved syntax,
|
|
model/catalogs and guards explicitly, then move SourceBundle into a narrow
|
|
owning accepted result. Failure returns located diagnostics and drops pending
|
|
output; no usable partial bundle or accepted token escapes. An owned accepted
|
|
bundle is not a self-referential parsed witness. Repeated retained-source editing
|
|
and actual filesystem/history installation remain distinct work.
|
|
|
|
## Whole equality and scratch
|
|
|
|
Reuse complete Project PartialEq, including established signed-zero semantics;
|
|
do not reuse rename::same_project, which intentionally exempts names. The
|
|
comparator's left operand must be the freshly resolved actual output model.
|
|
Use that resolver's actual raw-expression-site count E_actual as the conservative
|
|
equality frontier bound, reserving it against its live ledger before comparison
|
|
and releasing after equality returns. Original E remains provenance only and
|
|
cannot bound faulty emitted output. Existing planner proof covers Expr's iterative
|
|
frontier only when every actual left-model Expr root is represented in the source
|
|
expression arena; re-audit this reachability for full Project equality (including
|
|
opaque historical carriers) before selecting E_actual. Original scalar count is
|
|
not proof of actual output topology. No additional counting traversal or cloning
|
|
desired model should be introduced without its own bound.
|
|
|
|
Reject malformed bytes, model-invalid bytes, admissible-but-wrong aliases and
|
|
admissible-but-wrong non-name semantics. Error reporting must not recursively
|
|
format arbitrary models. Exact input/output policies survive; new parser Usage
|
|
is separate snapshot work. Output C remains live through syntax, resolver and
|
|
equality and must never be reset to zero or added twice.
|
|
|
|
## Required finite acceptance before implementation
|
|
|
|
Reuse published emitter exact OA/SA/all-file/Unicode/CRLF maps as independent
|
|
byte expectations. Construct at least one actual emitted owner whose inherited
|
|
profile admits original parse/index/plan/emission and then passes verification,
|
|
plus cap-minus-one refusal at the intended later stage; do not tighten a live
|
|
owner after admission. Fake/mutated pending bytes are labeled corruption controls.
|
|
Original empty/project rename may have a new combined producer peak greater
|
|
than the emitter's former114-byte oracle: recompute the whole pipeline honestly.
|
|
|
|
Test wrong-but-admissible output, malformed output, exact policies, complete
|
|
source/target immutability and scope/lifetime of returned ownership. Wide/deep
|
|
actual output versus target-only shape mismatch must establish equality's chosen
|
|
frontier bound. New tests do not replace existing public/legacy/fmt dispositions,
|
|
stack controls or the separately unrerun older full-pipeline setup limitation.
|
|
Full parsed-output acceptance remains private until a separate public integration
|
|
contract reconciles all16 schema8 failures and complete graphical/source behavior.
|