Requalify source-attached snapshot public candidate

Documentation/Architecture/ExtractionManifest.json

@@ -299,7 +299,9 @@
     "1.6 S3 G7 seeded grammar, scalar-key permutation tests, public replay consumer and strict cardinality/matrix harness are original Apache-2.0 contributions. The 64-schema authored fixture has SHA-256 cb55604183a6db7df5fa968db283e7abeae794277d2b0cef033b0bdb92e615cb. Independent python-jsonschema 4.26.0 is research qualification only, with exact numeric binding; no Python runtime dependency or copied validator/engine is distributed.",
     "1.6 S3 G8 materializes the unchanged synthetic corpus per caller access, replacing process-lifetime stored JSON payloads exposed by Linux ASan/LSan. The public process-lifetime consumer and strengthened exact/value-copy test are original Apache-2.0 qualification code; no suppression, runtime fallback, new dependency or corpus/digest change is introduced.",
     "Composition reference-load fixtures, serial descriptor staging, public-only adapter, capacity/terminal tests and strict CI receipt checks are original Apache-2.0 code. Generated JSON graphs introduce no upstream protocol fixtures, engine or dependency. Core public APIs, finite profiles and accounting weights are unchanged.",
-    "NAV5 public array-evidence packaging, external consumer and DocC are original Apache-2.0 code. Existing exact shape evidence, exclusive reducer, weights and I01-I17 semantics are unchanged; no upstream engine or dependency is adapted. Promotion is a draft candidate, not a released product."
+    "NAV5 public array-evidence packaging, external consumer and DocC are original Apache-2.0 code. Existing exact shape evidence, exclusive reducer, weights and I01-I17 semantics are unchanged; no upstream engine or dependency is adapted. Promotion is a draft candidate, not a released product.",
+    "NAV5 package-only complete structural snapshot, parent-linked metadata, original source-ownership transfer and S01-S24 synthetic tests are original Apache-2.0 code. The existing read scope admits once; its default public read/traversal/inspection completion behavior is preserved. No persistent identity, upstream algorithm or new dependency is introduced.",
+    "NAV6 snapshot access-level promotion, external consumer, independent 28-record maintainer oracle, terminal-transfer/concurrent lookup proofs and compiled DocC are original Apache-2.0 contributions. No upstream engine, new semantic authority, dependency or additional product is adapted."
   ],
   "jsonhtml_export_original_contributions": {
     "license": "Apache-2.0",

Documentation/Architecture/StructuralIntelligence/NAV7SnapshotReconciliation.md

@@ -0,0 +1,21 @@
+# NAV7 dependent snapshot candidate
+
+This draft replays37d84e8..b77d43d onto the NAV7 current-main N2 proposal,
+including #44 DocC index repair and #45 release metadata. Original #42/#43 and
+NAV6 heads remain unchanged. Snapshot source, read-scope ownership designation,
+exclusive context, all original S/V tests,14-case external consumer and compiler
+probe scripts are byte-identical to b77d43d. No algorithm replacement occurs.
+
+JSONInspection remains the one opt-in candidate product:44 Inspection declarations
+plus23 authored snapshot additions, with Navigation56 unchanged. Construction is
+one original scope/admission; a complete immutable snapshot owns one source and
+compact records. Each path/value/span lookup has its own explicit bounded full-
+source admission. Ordinals are local positions, not transferable node handles.
+
+G4 native performance remains HOLD with zero timed snapshot workloads and no
+retry authorization. Logical counters are policy, not RSS, allocation count or
+speed. This source requires fresh Debug/Release/ASan/TSan/strict, ownership/public
+negative codegen, external consumer, DocC/site, Linux, WASI/WasmKit, SDK and archive
+proofs. Actual outcomes are source-bound in the private NAV7 return; this document
+does not invent a pass. No merge, ready transition, release or public projection
+is authorized. P1 private experiments remain a separate conditional branch.

Documentation/Architecture/StructuralIntelligence/SnapshotExperiment.md

@@ -0,0 +1,85 @@
+# NAV5 I0 — Complete source-attached snapshot
+
+Status: accepted design for a package-only experiment; implementation remains
+conditional on the N2 public surface freeze and repeated owned-reducer proof.
+Base: frozen N2 API candidate 2e952c00ea2f4c2a943032a54f3a3fd85b1b96fb,
+with the subsequent generated-identity correction replayed separately. Both descend
+from 462f3ea and main 7d72c88. No public N3 API,
+new product, persistence, actor, projection, index-by-path or traversal option.
+
+## Representation and invariants
+
+One immutable Sendable snapshot holds one JSONDocument plus compact records.
+Each record contains ordinal, optional parent, optional exact edge component,
+kind, depth, immediate child count and a finalized half-open subtree end. No JSON
+subtree, absolute path, span, source bytes or label is stored per record. Ordinals
+are snapshot-local inputs to instance methods; no detached node/handle type exists
+and no API accepts a replacement document. Metadata lookup is bounds checked.
+
+The sole builder calls inspectOwned with its default complete physical root and
+no options or callback supplied by the caller. Before a depth-d hit, close stack
+entries while count > d, setting their ends to the next ordinal. The remaining
+top is the parent. Append the record and ordinal after charging storage. The
+root has depth 0 and nil parent/component. On finish, require complete summary,
+visited/emitted == records.count, and close every remaining frame at total count.
+No failed or cancelled finish returns an artifact. Empty/scalar roots yield one
+record. Metadata and parent links are immutable after initialization.
+
+## One original admission and source ownership transfer
+
+Existing JSONReadScope.complete refunds input/source ownership unconditionally.
+Returning a source-attached snapshot without extending that accounting would
+underreport live output; readmitting the document would duplicate work/quotas.
+Use a narrowly package-scoped, one-shot transferDocumentOwnership capability:
+check original scope health/owner and charge one work step, then designate the
+already-admitted source bytes as result-owned. At complete, refund paths and
+transient invocation storage as before, but retain the original rootBytes in the
+same report. The context method remains mutating and returns only the canonical
+immutable JSONDocument, never scope/state/meter/cursor. No new admission or ledger.
+
+Default false preserves every existing read/visit/collect/N2 completion statistic.
+Only the N3 finish path invokes transfer, after complete structural finalization.
+Invalidation always clears scope document/state; returned source is an ordinary
+immutable alias. Failure after transfer still returns no report/artifact, and
+scope teardown releases its references. Tests must prove exactly one admitted
+node/source-map count, captured source cost retained once, N1/N2 parity, and source
+release/terminal behavior. If this narrow package helper cannot preserve existing
+semantics or the compiler proof, do not implement N3 with a weaker meter.
+
+## Logical overlay v1 and complexity
+
+Declare 96 bytes per record (seven scalar/optional/enum slots plus component
+storage policy), plus exact UTF-8 key alias bytes, 16 per open ordinal frame and
+128 fixed snapshot/report bytes. Reserve each before append. Source ownership is
+the original read-scope admission cost, transferred once rather than recomputed.
+All record finalizations charge work and check cancellation; pop/refund a frame
+only after removal. These versioned logical weights are policy rather than Swift
+MemoryLayout, allocator behavior or RSS. No claimed hard physical-memory bound.
+
+Record retention O(nodes + key bytes), frontier O(depth). The existing walker
+constructs absolute hit paths: build work may be O(sum of depths), plus admission,
+key processing and finalization. Do not claim linear total construction or a speedup.
+
+## Separate bounded lookup
+
+Snapshot-scoped ordinal methods reject negative/out-of-range indices. Each path,
+value or span lookup starts an explicitly separate finite core operation, admits
+the captured immutable document using JSONReadScope, charges parent-chain work and
+temporary/output path retention, then delegates exact selection/source-map lookup
+to the core on that original scope. No lookup runs during build. Values are returned
+under existing read-value semantics; a returned JSON alias is caller value storage,
+not a second serialized graph. Path result ownership remains charged at handoff.
+No incomplete snapshot, missing-as-null or negative-query API is available.
+
+## Proof gate
+
+Keep N1's 56 public declarations and unmodified 2-positive/20-negative full-codegen
+matrix. Preserve I01-I17. Add S01-S24 structural, exact-key/number, source attachment,
+quota/cancel and generated depth/breadth tests; run Debug/Release, strict, sanitizers
+and qualified platform lanes. Actual source-bound results decide qualification;
+this ADR alone qualifies no executable behavior.
+
+The builder defaults to 100,000 records inclusive. Negative configuration fails
+before source admission; zero fails at the physical root with a typed capacity
+error. Invalid lookup ordinals precede source admission. Finalized subtree ends
+are nonoptional Int: no public or package result can carry an unfinished range.

Documentation/Architecture/StructuralIntelligence/SnapshotPromotion.md

@@ -0,0 +1,63 @@
+# NAV6 snapshot public candidate
+
+This isolated draft descends from original package-only N3 872b5fd and reconciled
+N2 37d84e8 (current main c79d48c). It proposes a public facade inside the existing
+JSONInspection product; it creates no additional SwiftPM product. No merge or
+release is authorized. Original #41/#42 evidence identities remain unchanged.
+
+## Accepted interface
+
+Keep JSONStructuralSnapshotBuilder(document:limits:), build(maximumRecords:),
+JSONStructuralSnapshot.document/recordCount, record(at:), location/value/sourceSpan
+(for:limits:), JSONStructuralRecord and the two existing typed failure cases.
+There are no public record/snapshot initializers or setters. The implementation
+remains the original package/private algorithm; no scope, meter, reducer, observer,
+borrowed cursor or source-rebinding capability becomes public.
+
+An ordinal is an integer position local to the snapshot method being called,
+never a detached node identity. Two sources may both have position 1 with different
+values; explicitly selecting each snapshot selects its own original source. No
+method accepts a record, handle or replacement document. The immutable document
+attachment keeps old snapshots coherent after other values are patched/replaced.
+
+## Ownership and errors
+
+Build performs complete physical preorder under Navigation’s one original scope
+and meter. Source ownership transfers once after finalized half-open subtree ends;
+ordinary read/visit/collect/inspectArray never transfer and preserve refunds. All
+three counters (record count, open depth, subtree end) are bounded by arrays and
+admitted nodes. Parent assignment uses existing indices; end equals records.count;
+ordinal < maximumRecords is checked before append, so count can at most Int.max
+without an increment from Int.max. No end/count arithmetic adds unchecked user
+integers. Core retention/work increments use checked UInt64 accounting. Supported
+wasm32 capacities retain the existing admission policy; no new narrowing occurs.
+
+Negative maximumRecords precedes admission; zero refuses the real root. No quota,
+cancellation, incomplete traversal or finalization failure returns an artifact.
+The exclusive context latches owned failures, including second transfer. A direct
+package read-scope transfer guard is an implementation primitive; public N3
+construction reaches it only through that guarded context. Post-transfer caller
+errors and quota/cancellation still invalidate the scope and publish no result.
+
+## Costs and qualification
+
+Overlay v1 remains 128 fixed logical bytes, 96 per record, edge-key UTF-8 bytes,
+16 per open frame, plus original source/path costs. Compact record retention is
+O(nodes + key bytes), while existing walker full-path storage and copying remain
+depth-sensitive. record(at:) is O(1) trusted-memory metadata access. Each location,
+value or span lookup is an explicitly separate finite operation with full source
+re-admission and core prefix/path/selection work. K lookups pay K admissions. These
+are semantic costs, not new performance claims; logical bytes are not heap or RSS.
+
+All I01–I17 and S01–S24 identities remain. Three new proofs add an independent
+28-record oracle, post-transfer terminal/lifetime cases and concurrent lookup
+health isolation. Exact discovery rises to 747 native / 731 Linux / 643 WASI,
+with 325/288 parameter invocations unchanged, 44 Inspection functions and 50/49
+shared-state functions. Preserve 49 cap probes, 126 maintenance identities,
+2-positive/20-negative full codegen, composition and schema-example lanes. Public
+qualification adds fourteen external cases, three executable DocC examples and
+18 external full-codegen negative outcomes. Requirements become passes only when
+actual source-bound receipts say so; SDK compilation is not device execution.
+
+Read the [compiled guide](../../../Sources/JSONInspection/Documentation.docc/StructuralSnapshots.md)
+and [independent consumer](../../../Tools/SnapshotQualification).

Documentation/CI/README.md

@@ -1,3 +1,8 @@
+# NAV6 snapshot integration
+
+Retains current main and all N2/N3 cases. Counts below are historical; the
+source-bound discovery manifest and receipts determine this candidate’s inventory.
+
 # NAV6 integrated inspection candidate
 
 Adds Inspection to schema-example-enabled main: ten products, nine libraries,
@@ -21,6 +26,19 @@ The following sections preserve their original increment histories.
 
 # NAV5 public inspection candidate
 
+# NAV5 package-only snapshot experiment
+
+This stacked candidate retains the N2 public surface and adds 24 snapshot cases.
+Root function inventories are 646 native, 630 Linux and 542 WASI; parameter case
+inventories remain 325 native/Linux and 288 WASI. Inspection has 41 functions;
+the focused inspection lane selects inspection|snapshot with exact discovery.
+Shared-state inventories add snapshotS19 (45 native, 44 Linux). No cap probe,
+restored maintenance identity, product or public declaration is added by N3.
+The new package-only source-ownership transfer preserves default input refunds;
+full compiler/safety and source-bound receipts remain required.
+
+## NAV5 public inspection candidate
+
 The candidate adds JSONInspection as the ninth product (eight libraries plus CLI).
 Its existing I01-I17 identities, root discovery, 49 cap probes and 126 restored
 maintenance identities are unchanged. Native/Linux invoke the external inspection

Documentation/Qualification/TestDiscovery.json

@@ -12,7 +12,7 @@
     "JSONCLITests": 88,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 17
+    "JSONInspectionTests": 44
   },
   "parameterized_invocations": 325,
   "composition_external_functions": 5,
@@ -35,7 +35,7 @@
     "JSONCLITests": 1,
     "JSONNavigationTests": 1,
     "JSONSchemaExamplesTests": 4,
-    "JSONInspectionTests": 1
+    "JSONInspectionTests": 3
   },
   "coverage_unmapped": {
     "Sources/JSON/Pointer/JSONLocationComponent.swift": "declaration-only enum",
@@ -76,7 +76,7 @@
     "JSONCLITests": 88,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 17
+    "JSONInspectionTests": 44
   },
   "wasi_root_functions": {
     "JSONTests": 190,
@@ -89,7 +89,7 @@
     "JSONBridgesTests": 10,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 17
+    "JSONInspectionTests": 44
   },
   "wasi_parameterized_invocations": 288,
   "portable_shared_state_functions": {
@@ -103,7 +103,7 @@
     "JSONCLITests": 1,
     "JSONNavigationTests": 1,
     "JSONSchemaExamplesTests": 4,
-    "JSONInspectionTests": 1
+    "JSONInspectionTests": 3
   },
   "export_functions": {
     "JSONSchemaTests": 1,

README.md

@@ -660,3 +660,12 @@ Full source admission still includes the unobserved suffix. Complete row evidenc
 can have restricted descendant traversal; structural rectangular width is not
 numeric matrix or schema admission. See the [compiled evidence guide](Sources/JSONInspection/Documentation.docc/ArrayEvidence.md),
 [public consumer](Tools/InspectionQualification) and [accounting contract](Documentation/Architecture/StructuralIntelligence/Inspection.md).
+
+The isolated NAV6 candidate also proposes complete source-attached structural
+snapshots inside JSONInspection. Read-only parent/edge records preserve physical
+preorder and finalized subtree ranges; every value/path/span lookup uses the
+captured document and an explicitly separate finite source admission. It adds no
+snapshot product, persistent identity or table certification. See the
+[snapshot guide](Sources/JSONInspection/Documentation.docc/StructuralSnapshots.md)
+and [public consumer](Tools/SnapshotQualification). This API remains an unmerged,
+unreleased draft candidate; published products retain their tagged contracts.