Rust Phase 4 native compiled graph semantics

Status: accepted with direct executable Rust evidence. This vertical slice ports deterministic identity, graph-wide semantic validation, and native project-to-graph production for all ten a0 row families.

Identity allocation

CompiledGraphIdentityAllocator owns scope and selector normalization, canonical ASCII JSON, duplicate-address detection, and UUIDv7 byte formatting. It matches all shared source, derived, supporting, Unicode, precedence, normalization, and failure vectors. RustCrypto sha2 supplies only SHA-256, and unicode-casefold supplies Unicode full case folding; both sit behind package-owned APIs and work without native FFI. Canonicalization and allocation policy remain in-house. Locked dependency versions and the package-owned API boundary are governed by the Rust workspace standard; neither dependency API is part of this public contract.

Semantic validation

Validation first applies the strict TypeSpec transport boundary, then builds each reference index exactly once. It validates RFC 4122 UUIDv7 row identity, uniqueness, typed references, exact bidirectional definition/page and occurrence/page ownership, exact hierarchy parent/child inverse ownership, terminal/local/component page ownership, scalar hierarchy bindings, resolution completeness, and graphical target attribution.

Hierarchy cycle detection uses one color map and marks each unit occurrence visiting and done once. Runtime is O(rows + references), retained validation memory is O(rows), and no collection cross-product or repeated parent-chain walk is used. The validator borrows generated DTO strings and does not clone row payloads. Compiler input and output ceilings belong to the upcoming named source-bundle/compiler operation; this already-owned DTO validator does not invent a second arbitrary size policy.

Native production boundary

CompiledSchematicGraphLimits independently bounds every emitted row family and aggregate retained string bytes. Each row check occurs before publication and each retained-string charge occurs before the corresponding graph allocation. Defaults are broad format-safety ceilings rather than product-size assumptions; native callers can retain them while untrusted-input adapters may tighten them. Source-bundle and connectivity limits separately bound parsed input, compiler work, and intermediate connectivity state.

Evidence and retained work

• The native allocator consumes the same language-neutral vectors as Python, including Unicode canonicalization.
• Shared Python/Rust negative vectors cover missing, duplicate, cross-owner, and hierarchy inverse failures; a wide-owner regression protects the indexed linear path.
• Focused Rust tests also cover valid semantics, wrong reference types, cycles, duplicate IDs, binding roles, and graphical target types.
• Rack L0_050 directly runs the generated Rust contract target, native allocator and semantic-validator target, producer limit target, and bounded-line validator example under four build jobs and two test threads.
• Rack L3_018 sends all four reference-project graphs through the native strict and semantic validators in one sequential native process. The process enforces its line ceiling while reading, before retaining bytes past the bounded payload-plus-line-ending allowance.
• build_compiled_schematic_graph emits definitions, occurrences, hierarchy, components, local nets, terminals, scalar hierarchy bindings, and graphical links from one indexed bundle and one compiled connectivity pass. Rack L3_020 compares the complete serialized graph exactly with Python for Yoshi, Taillight, Speedy, and Jumperless.
• A shared two-sheet differential proves two UUID-less sheet pins receive distinct deterministic render/source identities and hierarchy bindings; the fallback participates consistently in Python and Rust terminal and binding identity.
• The bundle index reads schematic.subpart_first_id and schematic.subpart_id_separator directly from the named project source. Default native netlist and graph entry points use those settings; a shared non-default digit-and-separator project proves complete graph parity.
• A synthetic two-sheet project exercises every row family, deterministic identity, portable source ownership, semantic validation, and exact/one-under limits for every family and aggregate retained string bytes.
• Production is linear apart from deterministic set/index ordering. Component and hierarchy-terminal lookup are indexed; unresolved hierarchy diagnostics do not rescan terminal rows. Graphical IDs use per-family borrowed indexes while retaining source order, avoiding per-push scans of a growing output vector.
• Package-owned unsafe code remains forbidden.
• Schematic mutation, semantic round-trip, and the bounded native CLI are governed by their accepted later slices; they remain outside this compiled-graph slice rather than open prerequisites for it.