Reconcile native composition with NAV8 for source-bound qualification

.github/workflows/composition-performance.yml

@@ -0,0 +1,43 @@
+name: Composition performance
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/composition-performance.yml'
+      - 'Scripts/qualify_composition_performance.py'
+      - 'Scripts/composition_host.py'
+      - 'Scripts/test_composition_performance.py'
+      - 'Sources/JSON/Limits/JSONCompositionScope.swift'
+      - 'Sources/JSON/Limits/JSONWorkMeter.swift'
+      - 'Tools/CompositionQualification/Sources/CompositionBenchmark/**'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: composition-performance-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  compare:
+    name: Composition / quiet native Release
+    runs-on: xcode-27
+    timeout-minutes: 30
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_27.2.app/Contents/Developer
+      SDKROOT: /Applications/Xcode_27.2.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
+      PYTHONDONTWRITEBYTECODE: '1'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Compare exact baseline and candidate on a quiet host
+        run: python3 -B Scripts/qualify_composition_performance.py --output .build/ci/composition-performance
+      - name: Preserve actual measurements and eligibility receipts
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: composition-performance
+          if-no-files-found: error
+          retention-days: 30
+          path: |
+            .build/ci/composition-performance/receipt.json
+            .build/ci/composition-performance/*.log

.github/workflows/linux.yml

@@ -43,7 +43,9 @@ jobs:
       - run: python3 -B Scripts/ci.py --lane '${{ matrix.lane }}'
       - name: Public composition and reference imports
         if: matrix.lane == 'linux'
-        run: python3 -B Scripts/ci.py --lane composition
+        run: |
+          python3 -B Scripts/ci.py --lane composition
+          python3 -B Scripts/ci.py --lane composition-proof
       - name: Preserve Linux receipts
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6

.github/workflows/native.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        lane: [native, safety, docs, archive]
+        lane: [native, safety, docs, archive, composition-proof]
     env:
       DEVELOPER_DIR: /Applications/Xcode_27.2.app/Contents/Developer
       PYTHONDONTWRITEBYTECODE: '1'

Documentation/Architecture/API.md

@@ -287,4 +287,25 @@ SHA-256 of the ordered Package.swift plus Sources content manifest, excluding on
 the generated identity file itself. It is not a Git commit, binary digest or claim
 of publication. Generation/checking needs no Git, time, environment or network.
 
+
+## Borrowed native composition
+
+`JSON.withComposition(limits:_:)` synchronously borrows a noncopyable,
+non-Sendable `JSONCompositionScope` and returns `JSONOperationReport<Result>`
+only after healthy finalization. The scope has no public initializer. Public
+methods parse a source-backed `Data` document, admit an existing value, construct,
+parse, append and resolve native Pointers, charge external work, reserve checked
+external logical bytes, checkpoint and tighten limits. Importing JSONSchema adds
+`uri(_:relativeTo:)` and `removingFragment(_:)`; JSON has no sibling dependency.
+URI operations use the core domain, with no compiled-plan or compilation-work
+charge. This slice does not compose schema compilation/evaluation or Codable.
+
+All owned errors latch the original failure. Neither a caught failure, a nested
+independent invocation nor later callback failure permits a completed outer
+report. Scope handles cannot escape the synchronous borrow or cross suspension.
+Native values may be returned; adapter-owned containers must be prepaid. Reports
+are ordinary publicly constructible values, not certification of arbitrary
+callback work. See [composition qualification](../Qualification/Composition/README.md)
+and the JSON DocC composition guide for the exact accounting/ownership contract.
+
 JSONNavigation product promotion preserves all 56 N1 public declarations and resource semantics. Full-source admission precedes invalid depth/record-option validation, including oversized sources; N1Promotion.md records this preserved precedence. JSON imports no Navigation symbols implicitly.

Documentation/Architecture/CompositionQualification.md

@@ -63,7 +63,7 @@ Run python3 Scripts/ci.py --lane composition on the supported native or Linux
 runner. The lane requires 12 core functions in each build mode, separate public
 consumers, five external Swift Testing functions in Debug/Release/ASan, all eight
 scale cells and 11 compiler rejection cases. Exact module/cardinality checks
-reject missing tests and misclassified resource failures. The reconciled 597 native / 581
+reject missing tests and misclassified resource failures. The reconciled 599 native / 583
 Linux root functions, 325 parameter invocations, restored identities and 49 public
 metric probes retain their existing contracts.
 
@@ -73,6 +73,13 @@ late missing-target/cancellation failures before attempting normal completion.
 Finalization must still throw the original native failure. Each report retains
 its actual source, environment, command exits, counts and input hashes.
 
+Completion additionally owns a 424-byte counter report and charges 50 work units.
+The retained threshold assertions include that independent buffer, and source input
+capacity is per document while reported bytes accumulate across all documents.
+The original two-argument reservation method is retained; a checked `overhead:`
+overload is additive. See [reconciliation](../Qualification/Composition/Reconciliation.md)
+for the independent ledger/mutant and compiler proof carried from PR #36.
+
 CI runs the focused lane alongside the existing Native / native and both Linux
 architecture jobs. Their names and protection rules remain unchanged. Sanitizer
 and full-root lanes continue independently. Linux uses the existing Swift

Documentation/Architecture/ExtractionManifest.json

@@ -302,7 +302,8 @@
     "NAV5 public array-evidence packaging, external consumer and DocC are original Apache-2.0 code. Existing exact shape evidence, exclusive reducer, weights and I01-I17 semantics are unchanged; no upstream engine or dependency is adapted. Promotion is a draft candidate, not a released product.",
     "NAV5 package-only complete structural snapshot, parent-linked metadata, original source-ownership transfer and S01-S24 synthetic tests are original Apache-2.0 code. The existing read scope admits once; its default public read/traversal/inspection completion behavior is preserved. No persistent identity, upstream algorithm or new dependency is introduced.",
     "NAV6 snapshot access-level promotion, external consumer, independent 28-record maintainer oracle, terminal-transfer/concurrent lookup proofs and compiled DocC are original Apache-2.0 contributions. No upstream engine, new semantic authority, dependency or additional product is adapted.",
-    "NAV8 current-main N3/P1 reconciliation, minimal public immutable projection API, independent 16-case consumer and DocC/access-control proofs are original Apache-2.0 contributions. NAV7 donor db991c5/bda8aef and packet SHA-256 57ca72cb817272ed466a7cb8810043d56a079190d830ea7b995abd308070f98d retain provenance. No external engine, dependency or product is added."
+    "NAV8 current-main N3/P1 reconciliation, minimal public immutable projection API, independent 16-case consumer and DocC/access-control proofs are original Apache-2.0 contributions. NAV7 donor db991c5/bda8aef and packet SHA-256 57ca72cb817272ed466a7cb8810043d56a079190d830ea7b995abd308070f98d retain provenance. No external engine, dependency or product is added.",
+    "Composition reconciliation retains PR35 native routes/reference fixtures and adds PR36 original Apache-2.0 report-overlap, per-document capacity/history, independent owned-event/mutant and compiler proofs. No third-party source or root dependency is added."
   ],
   "jsonhtml_export_original_contributions": {
     "license": "Apache-2.0",

Documentation/Architecture/ResourceLimits.md

@@ -159,3 +159,34 @@ uninstrumented adapter allocations and process RSS are outside the claim. A publ
 JSONOperationReport initializer permits pairing statistics with another result;
 its type alone does not establish provenance or adapter completeness. See the
 [composition guide](../../Sources/JSON/Documentation.docc/Composition.md).
+
+## Composition completion accounting
+
+
+The additive borrowed scope uses one original core ledger and the existing 49
+metrics/default profiles. It does not introduce adjustable counters or widen any
+cap. `chargeExternalWork` charges aggregate work before adapter work;
+`reserveExternalLogicalBytes(bytes,count:overhead:)` checks multiplication then
+addition and live retention before growth. Zero is valid but never establishes
+that opaque caller storage is free. All reservations are conservative until scope
+exit; repeated admission and physical aliases count again. Caller instructions,
+allocator capacity and process RSS remain outside this contract.
+
+`parseDocument` checks the full Data length against input and retained limits
+before allocating its copied byte buffer, charges each copied byte, then invokes
+the existing strict parser/source mapper. Caller Data is excluded. Input capacity
+is per document: the preceding input count is checked and retired into the same
+cumulative report before the next document. Work, retention, accepted-capacity
+history and first-failure identity never restart. Remaining core counts are
+conservative across the invocation; full source bytes/root/map and re-admitted
+Pointer inputs/outputs remain charged. URI identity is core work/storage, never
+schema compilation or compiledPlanBytes.
+
+Completion admits an additional 424 logical bytes (32 header + 49 eight-byte
+counter slots) and 50 work units (49 counter copies and one final work update).
+All result reservations overlap this report buffer. Overflow, quota failure and
+cancellation prevent a completed result/report even when caught by the adapter.
+No report is emitted after an error. Native accounting-version-1 weights and the
+ordinary entry points' accounting stay unchanged. This proof slice has no public
+release/promote tokens, refunds or partial reports. Independent adapter events
+and failing omitted-charge mutants qualify the authored adapter only.

Documentation/CI/README.md

@@ -1,3 +1,17 @@
+# R3 composition and NAV8 reconciliation
+
+This source combines immutable NAV8 main `0cb8ca40` with composition R2
+`1bf49535`. The final source discovery contract is [TestDiscovery.json](../Qualification/TestDiscovery.json);
+fresh compiler/event receipts must establish its complete Native/Linux/WASI,
+parameter, shared-state and module identities. Both composition lanes, NAV8
+private invariant and public projection consumers, all 49 finite caps and all
+126 restoration identities remain mandatory. Root dependencies remain empty;
+ten products include nine library catalogs. Controlled composition performance
+and universal compiler U02 remain separate held gates. Earlier owner decisions
+below apply only to their named source and do not admit this combined candidate.
+
+The following two sections preserve their original source histories and counts.
+
 # NAV8 Navigation V1 integration
 
 Current required discovery retains 779 native /763 Linux /675 WASI functions,
@@ -12,13 +26,39 @@ for this owner's guarded merge without performance claims.
 
 Earlier sections below retain their original source histories.
 
+# Composition reconciled with admitted Inspection main
+
+This candidate preserves current main `07912d8b28e186589e994e537b2485877a634a6b`
+and adds PR36's two native boundary functions: 722 native / 706 Linux / 618 WASI
+functions, 325 native/Linux / 288 WASI parameter invocations, 48 native / 47 Linux
+shared functions, ten products and nine catalogs. Both composition lanes, all
+49 caps and all 126 restoration identities remain mandatory. Actual receipts
+establish outcomes; controlled performance and compiler limitations remain separate.
+
+The following sections retain their original source identities and counts.
+
 # NAV6 integrated inspection candidate
 
 Adds Inspection to schema-example-enabled main: ten products, nine libraries,
 720 native / 704 Linux / 616 WASI functions, 48 native / 47 Linux shared functions.
 All 49 caps, 126 maintenance identities and schema/composition lanes remain.
 These are discovery expectations; receipts establish execution.
 
+# Composition proof reconciled with S3
+
+Reconciliation with main `c79d48c15f83ef88bed9459d9abcf05e54bd0bea` retains
+all schema-example, Navigation and composition behavior. Exact combined roots
+are 697 Mac / 681 Linux / 593 WASI functions, with 325 Mac/Linux and 288 WASI
+parameter invocations. Shared-state counts remain 47 Mac / 46 Linux. Nine products,
+eight library DocC catalogs, all 49 cap probes and all 126 restored identities
+remain mandatory. Both focused composition lanes and the complete S3 consumer,
+ownership, construction, matrix and corpus-lifetime checks are retained. The
+15-case Python harness rejects omitted dispatch and stale integration counts.
+Required check names and protections are unchanged. Quiet-host qualification
+remains pending separately; no timing comparison is scheduled by this integration.
+
+The following sections preserve their original source-specific counts.
+
 # Combined S3 / composition / Navigation qualification
 
 The current inventory requires 695 Mac / 679 Linux / 591 WASI functions,
@@ -57,6 +97,21 @@ memory compilation. Earlier sections retain their original source identities.
 
 # Native CI
 
+## Current composition proof
+
+The additive composition proof retains current main's Navigation product and
+adds two native boundary functions: exact discovery is 599 native / 583 Linux /
+495 WASI functions, with the same 325 native/Linux and 288 WASI parameter cases.
+Shared-state expectations remain 43 native / 42 Linux. Native/Linux still require
+33/29 commands, all 126 restored identities and 49 cap probes. The separate
+composition-proof lane additionally checks 26 public functions in both modes,
+two rejected omitted-charge mutants and 14 normal compiler rejections. Known
+compiler crashes remain separate limitations. Native CI now has five matrix
+lanes including composition-proof; protected names/settings are unchanged.
+The [controlled performance contract](../Qualification/Composition/Performance.md)
+requires genuine pre/post idle admission on its isolated native runner. The
+following counts retain their original stage context; receipts establish passes.
+
 ## Reconciled Navigation and composition increment
 
 Current source retains composition from main and adds the opt-in Navigation
@@ -295,3 +350,12 @@ The focused composition lane also runs on the Linux architecture jobs and Native
 Its separate-package discovery is additive; all root and 49-cap expectations remain intact.
 The qualification harness now has 15 regression functions, retaining its original 14.
 See [composition qualification](../Architecture/CompositionQualification.md) for finite capacity outcomes.
+
+The additive `composition-proof` lane runs two native boundary functions and the
+independent 26-function public suite in both configurations, two omitted-charge
+mutants and 14 separate diagnostic builds. Both focused lanes run on Linux;
+Native / composition-proof is separate from the protected names. The original
+reference-load lane and its exact counts remain required. The controlled
+composition performance job compares pinned main 30631e8 with this successor;
+[the reconciliation record](../Qualification/Composition/Reconciliation.md) states
+the expected accounting delta and unchanged idle/review thresholds.

Documentation/Qualification/Composition/FreshMainReconciliation.md

@@ -0,0 +1,39 @@
+# Native composition candidate on 1.7.0-dev
+
+This isolated candidate reconciles draft PR36 at
+`3571cb0d8aea5cf2c4ba454c5eab02ea2ce23f11` with admitted development main
+`07912d8b28e186589e994e537b2485877a634a6b`. Its native composition runtime is
+byte-identical to PR36. The root manifest, schema compiler/generator, Navigation,
+Inspection, independent fixtures and CLI version remain those of development main.
+The CLI source-content identity is regenerated by the unchanged generator.
+
+Both histories are retained. The CI dispatch, discovery assertions, provenance and
+DocC conflicts combine the two source contracts. The original documentation is
+preserved in the unchanged parent histories and source-bound receipts. The Composition
+guide fence changes main's inferred closure parameter to an explicit
+`(scope: borrowing JSONCompositionScope)` parameter; that fence is not byte-identical
+to main. Other original documentation clauses and executable fences remain.
+Current roots require 722 native / 706 Linux / 618 WASI functions, with 325/325/288
+parameter invocations and 48 native / 47 Linux shared functions. The separate
+public proof now requires 29 functions: the original 26 plus three cases for the
+pinned 577/152/578-byte sources, sticky typed parser/resource errors and exact
+source/number/scalar/Pointer/URI semantics with all 49 final counter slots.
+
+The supplied six fixture files retain their byte identities in the public test
+resource bundle. They are synthetic JSON and introduce no protocol dependency.
+Policy exclusions remain separate from evaluated corpus outcomes. The independent
+adapter trace remains 197 work / 664 logical bytes including native completion;
+its two causal undercharge mutants and all 14 normal compiler negatives remain.
+
+Qualification is source-bound. This document defines the candidate and replay
+requirements; it does not declare CI, compiler U02 or controlled performance passed.
+Use the composition, composition-proof, native, safety, docs, archive, Linux and
+WASI lanes and the unchanged quiet-host performance harness. Known compiler aborts
+are distinct from ownership diagnostics, and explicit borrowed helper parameters
+remain the supported caller form. A passing subset does not establish universal
+static non-escape. Performance requires every pre/post window at least 90% idle,
+no paging and review of any positive elapsed increase above 10%.
+
+No PR40 admitted roots, runtime handle, downstream pin, merge or release is included.
+Published 1.6.0/1.6.1 tags and assets remain immutable. The downstream source-budget
+and final-wrapper migration needs a separate accepted SHA and owner review.