Repair native preparation funding and canonical journal allocation
Native preparation exceeded the existing ledger and released JSON custody while returned state was still alive. Fund preparation from the original task ledger, retain container storage until destruction, and remove repeated journal and metadata work so the complete native example fits its original allowances.
- Reserve transition-header bytes before constructing state, without charging an allocation operation for the inline header. Keep returned JSON and namespace allocations in their enclosing volume custody.
- Encode closed journals directly, reuse immutable Intent decoding and payload hashes, prewrite completion prefixes, and update only trailing counters after physical action. Avoid unchanged regular-file rewrites only after complete metadata and authenticated content equality. Open root metadata relative to the held directory descriptor.
- Preserve staging owner/tail fences. The production phase controller uses the crate-local synchronization shim, with a dedicated loom model, lock-order assertions, and a broken-fence negative control. Use a current-thread example runtime to avoid repeated worker-pool startup.
- Count object entries first and reserve one scratch Vec. Sort without allocating, then admit a conservative whole-object B-tree node bound before insertion: at most
1 + (entries - 1) / 5nodes for a nonempty object, using the audited eleven-slot capacity and minimum non-root occupancy. Allocation properties require physical counts to be covered, with explicit occupancy-derived slack. - Fund RawValue buffers, scratch and nodes before allocation through the same bounded decoder. Defer writer admission failures to the typed outer boundary so Serde cannot allocate an error box after denial. Parse scalar numbers without Serde's heap-backed float slow path.
Validation
Current head f1851acb57ea188a0c580009a563f5db1d02b127, local Windows debug, through Q:/lanes/lb.ps1:
| Check | Result | Wall time |
|---|---|---|
Focused Harness executor::json:: suite | 14 passed | 1.55 s |
Harness cargo check --lib --tests | Passed | 18.17 s |
Standalone bounded_json fuzz binary check | Passed | 97.64 s |
Runtime tests use the built binary directly; compilation is excluded from the 1.55 s. The final test rebuild took 463.17 s, including 105 s waiting for a local slot. The first run exposed an additional large-exponent float allocation; its minimized shrinking regression and fuzz seed are checked in and the corrected suite is green. Prefix properties cover every allocation budget index for recursive Values, RawValues, ordinary records/enums, escapes, negative zero, and the 18/19-key boundary. They check typed exhaustion, physical allocations against receipt deltas, peak custody, and cleanup. The seeded fuzz target covers both Value and RawValue construction, including duplicate input entries.
Previously accepted unchanged paths at 2cf1af77599a057979379908b647760b3e72b179: staging loom and negative control 0.030 s; callback allocator/custody properties 0.031 s; complete canonical native example 7.743 s. These were not rerun for this JSON-only delta. Earlier Intent/journal compatibility and seeded fuzz runs remain recorded in lane results; the modified bounded_json target was checked, not fuzz-run in this delta.
Decisions
- Keep the original finite limits, custody invariants, and typed native exhaustion. Admit conservative tree capacity instead of depending on private split positions.
- Reuse the canonical native feature closure and debug profile. Apply the coordinator's local Windows maintenance override; cancel the obsolete bb1 request before any remote build, with no remote request left queued.
- Keep the approved example and accepted staging implementation unchanged in this delta. Extraction stays on hold for coordinator review; no extraction PR is included.
Formatting, LF/source-size checks, git diff --check, and SSH commit-signature verification pass. PR is ready for coordinator review and merge.