Rust S-Expression Phase 1 Promotion Review

Decision

Phase 1 is accepted for typed-reader expansion. The promoted parser boundary includes safe native and WASM scan/build operations, selective and streaming reads, a reusable structural index, deterministic generic builds, and source-preserving patches. Typed converter paths must consume spans and borrowed views directly; constructing a generic full-file tree is a compatibility path, not the typed-reader architecture.

Correctness Evidence

• Rack L0 passes all 49 foundation subtests: 1,447 tests passed and the advisory performance case was the only skip in the fast lane.
• Shared Python/Rust vectors cover canonical build output, error phase, KiCad escapes, comments, numeric boundaries, malformed nesting, and stable second writes. Property tests add generated semantic round trips and malformed-input coverage.
• Streaming selection equals in-memory selection across every chunk size from one through seventeen bytes. Partial reads, UTF-8 failures, depth, selected-form, source-size, and form-size limits fail closed.
• Source patches preserve untouched bytes and semantic reparsing while rejecting overlaps, invalid source boundaries, and output growth past the caller limit.
• Actual Node-hosted WASM tests exercise canonicalization, typed build, bounded build output, and structured scan resource-limit diagnostics.
• Rack L1_022 covers all 1,774 corpus files with per-file memory release; the largest accepted input is 71,556,836 bytes.

Architecture And Safety

• Workspace and crate lint policy forbids package-owned unsafe code. No exception is needed for the parser slice.
• Core parsing depends only on the standard library. Serde, TypeSpec generation, and wasm-bindgen remain at contract and adapter boundaries.
• TypeSpec owns the operation envelopes. Rust, strict Python msgspec, strict TypeScript, and JSON Schema projections are generated and checked for drift.
• Selected spans remain source ordered. Their current final sort and owned paths are known complexity watchpoints, not correctness defects; changing them without a real typed-reader profile is not authorized.

Deferred Performance Gates

Existing Windows corpus and selected-span measurements are retained as advisory evidence. Linux threshold ratification, deep-path ownership, many-path selectors, streaming/patch timing, and browser transfer timing move to the pre-cutover review or may be triggered by an observed typed reader profile. They do not block the first typed model.

Authorized Next Boundary

Phase 2 may add a TypeSpec-first footprint reader/writer operation over caller-owned bytes. The first cut must preserve unknown forms during a focused edit, prove semantic write/reparse and stable second output, use the shared bounded parser primitives, and expose the same operation shape to native Rust and WASM without a generic full-file tree.