Prove bounded private tree and sparse table projections

AGENTS.md

@@ -35,4 +35,6 @@ Documentation/Architecture before changing behavior.
   user instruction. Preserve unrelated changes.
 
 Scalar scanning and immutable plan-local regex sharing are selected private
-optimizations. Projection and JSON text-sequence framing remain deferred.
+optimizations. Public projection APIs and JSON text-sequence framing remain deferred. Package-only
+NAV7 tree/sparse-table proofs stay experimental inside JSONInspection, with no
+additional product/target and no merge or performance qualification implied.

Documentation/Architecture/ExtractionManifest.json

@@ -17,7 +17,7 @@
       "blob_sha": "25cb8eab982ed0fc41e5f1dde5abeab18113f55e",
       "destination": "Sources/JSON/Value/JSON.swift",
       "disposition": "Six enum case concepts selectively adapted; equality/hash traversal and exact object/key storage rewritten.",
-      "attribution": "Original Thor Fuchs 2024–2026 header retained; Reference LICENSE and NOTICE preserved.",
+      "attribution": "Original Thor Fuchs 2024\u20132026 header retained; Reference LICENSE and NOTICE preserved.",
       "validation": [
         "Tests/JSONTests/ValueTests.swift",
         "Tests/JSONTests/PresenceTests.swift"
@@ -163,7 +163,7 @@
       "blob_sha": null,
       "destination": "Sources/JSONRegexRuntime/RegexUnicodeTables.swift",
       "disposition": "407 immutable tables generated by original deterministic Python generator from fixed Unicode data; no generated Regress table copied. Regeneration compares bytes and provenance.",
-      "attribution": "© 2020 Unicode, Inc.; Unicode-3.0 copyright/permission notice retained in Licenses/Unicode-3.0.txt.",
+      "attribution": "\u00a9 2020 Unicode, Inc.; Unicode-3.0 copyright/permission notice retained in Licenses/Unicode-3.0.txt.",
       "validation": "Byte-equal regeneration and native exact-alias/GC/binary/Script/Script_Extensions/IdentifierName vectors",
       "evidence": "Scripts/ci.py: current native, safety and documentation receipts"
     },
@@ -174,7 +174,7 @@
       "blob_sha": null,
       "destination": "Sources/JSONSchema/Formats/JSONIDNAData.swift and Tests/Fixtures/Unicode/NormalizationTest-13.0.0.txt",
       "disposition": "Original generator derives RFC5892/5893, NFC and UTS46 nontransitional STD3 tables; normalization fixture copied byte-for-byte. No external engine or system Unicode authority.",
-      "attribution": "© 2019–2020 Unicode, Inc.; Unicode-3.0 notice preserved in Licenses/Unicode-3.0.txt.",
+      "attribution": "\u00a9 2019\u20132020 Unicode, Inc.; Unicode-3.0 notice preserved in Licenses/Unicode-3.0.txt.",
       "validation": "18853 normalization cases (94265 native comparisons); 874 independent optional format cases; byte-equal regeneration",
       "evidence": "Scripts/ci.py: current native, safety and documentation receipts"
     },
@@ -311,5 +311,17 @@
     "framework_boundary": "Conditional CoreTransferable/UniformTypeIdentifiers plus a narrow explicit main-actor Apple PDF boundary using WebKit, CoreText, CoreGraphics and AppKit/UIKit paragraph styles. Core JSON imports none of these; no new root dependency.",
     "rtf": "Original bounded strict-token emitter; AppKit/UIKit native decoding only in tests and qualification consumers, not generation.",
     "pdf": "Original invocation-owned lifecycle, finite adapter accounting and visible-range pagination using Apple SDK APIs. PDFKit is independent qualification only; no third-party renderer adapted."
+  },
+  "nav7_projection_original_contributions": {
+    "license": "Apache-2.0",
+    "adapted_third_party_code": false,
+    "source": [
+      "Sources/JSONInspection/Projections/JSONTreeProjection.swift",
+      "Sources/JSONInspection/Projections/JSONSparseTableProjection.swift"
+    ],
+    "scope": "Package-only P1-A proof; canonical model, original exclusive traversal reducer, no new target/product or external dependency. No N1/N2/N3 algorithm changed.",
+    "fixture_provenance": "Twelve immutable owner-supplied NAV7 synthetic JSON fixtures plus eight independently generated deterministic scale workloads and independent packet oracle; SHA256 records in test fixture manifests.",
+    "input_packet_sha256": "c42e9ed22003bf223b68a191fddea490462e5138a229c0f45739367dc96a3882",
+    "qualification": "Scripts/ci.py --lane inspection plus full Native/Linux/WASI/SDK and compiler/public API gates; actual source-bound receipts required."
   }
 }

Documentation/Architecture/StructuralIntelligence/P1PrivateProjections.md

@@ -0,0 +1,90 @@
+# NAV7 P1-A private projection proof
+
+Status: isolated package-only experiment, no new target or product, no merge/
+release/public-API approval. JSONInspection hosts the proof beside its immutable
+snapshot. A separate JSONProjections module would add an interface solely for
+private reuse; this wave needs no additional module boundary. N1/N2/N3 code and
+public declarations remain unchanged. Exact compiled declarations/proofs are
+recorded in the NAV7 return, not inferred from this design note.
+
+## Source and API
+
+`JSONTreeProjection.build(snapshot:rootOrdinal:limits:)` accepts a complete sealed
+snapshot and returns a view of an original physical interval. It stores that
+snapshot, selected root ordinal and finalized end only. Root metadata keeps its
+original parent/depth; no synthetic root/value/DOM is constructed. Ordinary fixed
+`record(at:)` reads have no new owned growth/report. `children` and `subtreeOrdinals`
+are new bounded catalogue operations with an inclusive100000-record default; they
+reject insufficient caps and never publish truncation. Direct children jump
+finalized subtree ends. `location`, `value`, `sourceSpan` validate local view bounds,
+then delegate exactly once to the existing independent N3 operation.
+
+Every tree build/catalogue invocation uses the established N1 exclusive reducer,
+one original read scope and complete captured-source admission. Root-only traversal
+reuses already-proven complete snapshot topology; it does not rebuild the tree or
+continue the completed snapshot build's meter. Snapshot/row ordinals are local
+positions, not portable identifiers. A bare Int can be reused as a position in
+another source, but this API accepts no replacement source or detached node handle.
+
+`JSONSparseTableProjection.build(document:at:limits:maximumRows:maximumColumns:
+maximumPresentCells:)` selects one existing array. Every row must be object or a
+`nonObjectRow(at:kind:)` error identifies the exact physical row. Full source
+admission precedes success, including unselected input. Empty0x0 is explicitly
+allowed; `[{},{}]` is2x0. Positive N2 prefix evidence cannot admit an unseen suffix.
+Rows remain original array indices, including equal rows. JSONKey columns follow
+first encounter in source member order. Sparse member/column ordinal references
+and nondecreasing row offsets retain empty rows without a dense null grid.
+P27's offsets can be equal for empty rows; demanding strict increase would
+contradict P18. Each nonempty row advances the offset.
+
+`cell(row:column:limits:)` is a separate original-source-admitted read operation.
+It charges row-reference scans and delegates key/presence to core JSONObject
+lookup/comparison. It returns canonical JSONPresence absent/null/value, preserves
+arrays/objects/exact numbers/lexemes, and throws for bad bounds or inconsistent
+metadata. It stores no per-cell JSON/path/span, normalizes no key and converts no
+number. Wrong type, missing selection, nonobject, operational failure and null
+remain distinct. The captured immutable source cannot be rebound.
+
+## Finite accounting policy v1
+
+All49 core profiles/caps are unchanged. Additional inclusive defaults are100000
+rows,10000 columns and1000000 present members; negative configuration fails before
+admission. Tree catalogue default is100000 records. Arithmetic products and count
+increments are checked before growth. Each scan, key comparison, finalization
+step, returned slot and key alias is charged on the original invocation ledger.
+Unexpected capacity/resource/cancellation failures throw without successful output.
+
+Logical output overlays, plus core source/selection costs:
+
+- Tree view:64 descriptor +128 snapshot header +96 per retained record alias and
+  exact UTF8 edge-key bytes. COW sharing does not erase logical alias ownership.
+- Catalogue:32 header +8 per ordinal;96 temporary record bytes are refunded.
+- Table:256 summary +8 per offset +64 per column plus exact UTF8 key bytes +16 per
+  present member reference. A complete source ownership transfer occurs once.
+
+These are declared logical weights, not MemoryLayout, allocation bytes or RSS.
+Sparse slots are O(rows+columns+present members); exact linear column scans may
+be quadratic. Tree build/lookup costs still include full source/map admission;
+N1/N3 path reconstruction remains depth-sensitive. No time, RSS, throughput or
+scalability improvement is claimed. G4 remains HOLD with zero timed workloads.
+
+## Proof and boundaries
+
+32 Swift Testing identities cover all P01–P32 obligations and independent packet
+oracles, exact keys/pointers/presence, deep16/64/256 and wide1024 trees, sparse
+1/16/1024/10000 rows, core differentials, inclusive caps/work/retention, checked
+overflow,16 concurrent mixed-success/failure views and cells, actual source
+retention, legacy statistics parity, source replacement and post-finalization
+terminal priority. Cancellation is exercised inside long key scans, offset
+finalization and after source transfer; scope root/state invalidation is observed.
+No deallocation of caller aliases or process-memory bound is claimed.
+
+The compiler qualifier requires ordinary primary diagnostics in Debug/Release:
+external packages cannot name the package types; even same-package code cannot
+forge a tree via its file-private initializer or mutate table source/columns.
+Original ownership2-positive/20-negative and public Snapshot18-negative probes
+remain separate. The full supported native/safety/docs/portable/SDK/archive lanes
+must bind to final source. SDK builds do not establish device/simulator runtime.
+Public projection surfaces, batching, persistence, durable identity, query DSL,
+BFS/matrix/graph/retrieval, mutation, renderer/CLI integration and EngineBench are
+future owner gates. No release version is assigned by this prototype.

Documentation/CI/README.md

@@ -1,3 +1,29 @@
+# NAV7 package-only projection proof lane
+
+The experimental P1 branch retains all existing products and public declarations.
+It adds exactly32 P01–P32 functions to JSONInspectionTests:76 total in that module,
+779 native/763 Linux/675 WASI root functions. Parameter counts325/288, all49 caps
+and126 maintenance identities remain unchanged. Shared-state counts are51 native
+and50 Linux, including the new combined tree/table16-task proof. The discovery
+contract pins every P function identity, rejecting missing/renamed/duplicate cases.
+
+`--lane inspection` now has seven commands: all76 I/S/V/P functions Debug/Release/
+ASan, strict compilation, original2-positive/20-negative full-codegen matrix and
+the new private compiler qualifier. That qualifier has24 commands,2 legal and14
+ordinary negative codegen cases, plus a five-case same-package consumer/config.
+The package-only probe is not a public product or external public consumer; the
+existing independent12-case Inspection and14-case Snapshot consumers remain.
+Full native/Linux runtime lanes include the new qualifier. The Python harness has
+16 meaningful regression tests and retains every original failure counterexample.
+
+No new target/product, private-engine dependency, portability lane or baseline
+exception is introduced. Nine public candidate library catalogues still document
+1144 authored declarations; the projection proof is absent from public symbols.
+Actual receipts establish outcomes, not these expectations. Native performance
+G4 remains HOLD, with no new benchmark or timing/RSS/scalability claim.
+
+The following source-stage sections are historical and retain their own counts.
+
 # NAV6 snapshot integration
 
 Retains current main and all N2/N3 cases. Counts below are historical; the

Documentation/Qualification/ProjectionCases.json

@@ -0,0 +1,38 @@
+{
+  "module": "JSONInspectionTests",
+  "functions": [
+    "JSONInspectionTests.projectionP01ScalarRootIsOneExactLeaf()",
+    "JSONInspectionTests.projectionP02EmptyContainerKindsStayDifferent()",
+    "JSONInspectionTests.projectionP03RootAndEmptyKeyHaveDifferentLocations()",
+    "JSONInspectionTests.projectionP04NumericKeysAndIndicesAreNotAliases()",
+    "JSONInspectionTests.projectionP05ScalarExactUnicodeKeysNeverNormalize()",
+    "JSONInspectionTests.projectionP06ChildrenJumpOverGrandchildren()",
+    "JSONInspectionTests.projectionP07SourceInsertionAndArrayOrderAreCanonical()",
+    "JSONInspectionTests.projectionP08EveryRangeMatchesIndependentPacketOracleAndCore()",
+    "JSONInspectionTests.projectionP09EqualSiblingsKeepDistinctPhysicalPositions()",
+    "JSONInspectionTests.projectionP10SelectedSubtreeKeepsOriginalRootAndParent()",
+    "JSONInspectionTests.projectionP11ReplacementCannotRebindAViewOrGivePortableOrdinals()",
+    "JSONInspectionTests.projectionP12OnlyCapturedCoherentSourceSuppliesSpans()",
+    "JSONInspectionTests.projectionP13InclusiveCatalogueCapsNeverReturnTruncation()",
+    "JSONInspectionTests.projectionP14TreeWorkRetentionKeysAndCancellationAreBounded()",
+    "JSONInspectionTests.projectionP15DeepAndWideCataloguesRemainIterativeAndFinite()",
+    "JSONInspectionTests.projectionP16SharedViewsHaveIndependentHealthAndLegacyStatistics()",
+    "JSONInspectionTests.projectionP17EmptyArrayIsExplicitCompleteZeroByZero()",
+    "JSONInspectionTests.projectionP18EmptyObjectRowsNeverDisappear()",
+    "JSONInspectionTests.projectionP19EveryNonObjectRowFailsAtItsPhysicalPath()",
+    "JSONInspectionTests.projectionP20PositivePrefixCannotAdmitLateBadTable()",
+    "JSONInspectionTests.projectionP21ColumnsFollowFirstEncounterAcrossPermutations()",
+    "JSONInspectionTests.projectionP22UnicodeColumnsHaveExactSeparatePresence()",
+    "JSONInspectionTests.projectionP23EqualRowsRemainSeparatePhysicalRows()",
+    "JSONInspectionTests.projectionP24CellPresenceHasThreeCanonicalStates()",
+    "JSONInspectionTests.projectionP25MissingCountsUseEveryAdmittedObjectRow()",
+    "JSONInspectionTests.projectionP26NestedValuesAndExactNumbersRemainAtSource()",
+    "JSONInspectionTests.projectionP27SparsePrefixesAndMemberOrdinalsMatchOracle()",
+    "JSONInspectionTests.projectionP28BadBoundsKindsConfigurationPathsAndDuplicatesThrow()",
+    "JSONInspectionTests.projectionP29ScaleCapsAndCheckedProductsPrecedeGrowth()",
+    "JSONInspectionTests.projectionP30ConstructionHasOneAdmissionAndRetainsExactSparseOutput()",
+    "JSONInspectionTests.projectionP31CellLookupIsIndependentFullSourceAdmission()",
+    "JSONInspectionTests.projectionP32FinalizationFailureCancellationAndScopeTeardownAreTerminal()"
+  ],
+  "scope": "P01\u2013P32 private prototype; every exact identity required"
+}

Documentation/Qualification/TestDiscovery.json

@@ -12,7 +12,7 @@
     "JSONCLITests": 88,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 44
+    "JSONInspectionTests": 76
   },
   "parameterized_invocations": 325,
   "composition_external_functions": 5,
@@ -35,7 +35,7 @@
     "JSONCLITests": 1,
     "JSONNavigationTests": 1,
     "JSONSchemaExamplesTests": 4,
-    "JSONInspectionTests": 3
+    "JSONInspectionTests": 4
   },
   "coverage_unmapped": {
     "Sources/JSON/Pointer/JSONLocationComponent.swift": "declaration-only enum",
@@ -76,7 +76,7 @@
     "JSONCLITests": 88,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 44
+    "JSONInspectionTests": 76
   },
   "wasi_root_functions": {
     "JSONTests": 190,
@@ -89,7 +89,7 @@
     "JSONBridgesTests": 10,
     "JSONNavigationTests": 47,
     "JSONSchemaExamplesTests": 98,
-    "JSONInspectionTests": 44
+    "JSONInspectionTests": 76
   },
   "wasi_parameterized_invocations": 288,
   "portable_shared_state_functions": {
@@ -103,7 +103,7 @@
     "JSONCLITests": 1,
     "JSONNavigationTests": 1,
     "JSONSchemaExamplesTests": 4,
-    "JSONInspectionTests": 3
+    "JSONInspectionTests": 4
   },
   "export_functions": {
     "JSONSchemaTests": 1,

Package.swift

@@ -22,7 +22,7 @@ let package = Package(
         // Opt-in N1 product candidate; promotion does not change core navigation semantics.
         .target(name: "JSONNavigation", dependencies: ["JSON"]),
         .target(name: "JSONInspection", dependencies: ["JSON", "JSONNavigation"]),
-        .testTarget(name: "JSONInspectionTests", dependencies: ["JSONInspection", "JSONNavigation", "JSON"]),
+        .testTarget(name: "JSONInspectionTests", dependencies: ["JSONInspection", "JSONNavigation", "JSON"], resources: [.copy("ProjectionFixtures")]),
         .testTarget(name: "JSONNavigationTests", dependencies: ["JSONNavigation", "JSON"], exclude: ["Fixtures"]),
         .target(name: "JSONBridges", dependencies: ["JSON"]),
         .testTarget(name: "JSONIntegrationTests", dependencies: ["JSON", "JSONSchema", "JSONStreaming", "JSONPatch"]),