O1b-0: отделить подготовку Session от commit

crates/labcolors-core/contracts/clean-set-srgb8-v1/receipt-v1.json

@@ -62,11 +62,11 @@
       "sha256": "8c9838107077775c51d80638ba0b59f9672d14347ca404dfd4c63e2fb62d1c45"
     },
     {
-      "bytes": 169898,
+      "bytes": 173158,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program.rs",
       "role": "program_facade_source",
-      "sha256": "10195d665228073345b3c453c49c4cce99bc168da5dd5e70932f34e0cead1873"
+      "sha256": "b93e1d066d03d28abc49bdfd492025da7c8fd8531fd19d8ab29526aeeb29a7ae"
     },
     {
       "bytes": 71522,
@@ -83,11 +83,11 @@
       "sha256": "a236381dcf80760e1ea39743b3a20d10de938fe1a9d6c64e9a9075f6265b6eb3"
     },
     {
-      "bytes": 21581,
+      "bytes": 21649,
       "license": "MIT",
       "path": "crates/labcolors-core/src/program_clean_set_tests.rs",
       "role": "program_tests",
-      "sha256": "4a02dc8aa1c08649fb04797bdcb713c0356e167b63c5f8e17207fdee92556f2b"
+      "sha256": "30bbb97208b428d2ca0e5a230bffa0e2a8e1ede5b0b071979c7a7b2590f57d93"
     },
     {
       "bytes": 11370,
@@ -97,11 +97,11 @@
       "sha256": "aa6aa7c0b630437f1c1ba8c2ceafb0dadf6551c42331559504076a6cd44e6331"
     },
     {
-      "bytes": 11785,
+      "bytes": 15043,
       "license": "MIT",
       "path": "crates/labcolors-core/src/session.rs",
       "role": "session_runtime_source",
-      "sha256": "4f77643206077c080e5e9b182e896145bfb69bf3db8aa4c1ac7d4c5360ea8504"
+      "sha256": "4c24ffb02ac5909d8436410ba233aec8abd99156e55ac9d65232ca614de92905"
     },
     {
       "bytes": 34105,

crates/labcolors-core/contracts/clean-set-srgb8-v1/receipt-v1.sha256

@@ -1 +1 @@
-874926f880901e5b9ffeb0fb23a6466f9745a5a120ca29b47309b7c078aa9a40  receipt-v1.json
+e55be72b39800c75b3009378734089b2474041e8598557e3ac3f82dbe67dc985  receipt-v1.json

crates/labcolors-core/src/generic_boundary_tests.rs

@@ -423,28 +423,154 @@ fn staged_session_keeps_evidence_but_owner_alone_grants_updates_and_operations()
     );
     for required in [
         "pub(crate) fn project<'owner, 'session>(",
-        "pub(crate) fn update<'owner, 'session>(",
+        "pub(crate) fn prepare_update<'owner, 'session>(",
         ".owns_session(&session.session)",
     ] {
         assert!(
             owner_api.contains(required),
             "the exact owner must remain the only operation authority; missing `{required}`",
         );
     }
-    let update = source_scope(
+    let prepare = source_scope(
         owner_api,
-        "pub(crate) fn update<'owner, 'session>(",
+        "pub(crate) fn prepare_update<'owner, 'session>(",
         "pub(crate) fn instantiate(",
     );
     assert!(
-        update
+        prepare
             .find(".owns_session(&session.session)")
-            .expect("owner update must preflight exact membership")
-            < update
-                .find("session.apply_update(update)?")
-                .expect("owner update must delegate one atomic Session update"),
+            .expect("owner prepare must preflight exact membership")
+            < prepare
+                .find("let transition = session.prepare_update(update)?")
+                .expect("owner prepare must delegate one prepared Session transition"),
         "owner mismatch must be rejected before admission, allocation, or evaluation",
     );
+    assert!(
+        !owner_api.contains("pub(crate) fn update<'owner, 'session>("),
+        "Owner must not retain an immediate prepare-and-commit authority",
+    );
+
+    let session_code = normalized_production_code(SESSION_SOURCE);
+    let program_code = normalized_production_code(PROGRAM_SOURCE);
+    for forbidden in [
+        "pub(crate) fn update(",
+        "pub(crate) fn update_unknown(",
+        "pub(crate) fn update_schema_ordered",
+        "fn apply_prepared_update(",
+    ] {
+        assert!(
+            !session_code.contains(forbidden),
+            "generic Session must not retain immediate authority `{forbidden}`",
+        );
+    }
+    assert!(
+        !program_code.contains("fn apply_update("),
+        "concrete Program Session must not retain immediate authority",
+    );
+
+    let prepared_owner = source_scope(
+        SESSION_SOURCE,
+        "pub(crate) struct PreparedSessionTransition<'session, Plan: SessionPlanV1> {",
+        "impl<'session, Plan: SessionPlanV1> PreparedSessionTransition<'session, Plan>",
+    );
+    for required in [
+        "raw_head: &'session mut SessionObservationHeadV1,",
+        "state: &'session mut SessionState<Plan::Verified, Plan::Violation>,",
+        "pending: PendingSessionTransition<Plan::Verified, Plan::Violation>,",
+        "owner: Plan::OwnerLease,",
+    ] {
+        assert_eq!(
+            prepared_owner.matches(required).count(),
+            1,
+            "the linear transition must own exactly one `{required}`",
+        );
+    }
+    assert!(
+        !prepared_owner.contains("derive(Clone") && !prepared_owner.contains("derive(Copy"),
+        "prepared lifecycle authority must remain linear",
+    );
+    assert!(
+        prepared_owner
+            .find("pending: PendingSessionTransition<Plan::Verified, Plan::Violation>,")
+            .expect("prepared transition must own pending evidence")
+            < prepared_owner
+                .find("owner: Plan::OwnerLease,")
+                .expect("prepared transition must retain its exact owner lease"),
+        "Rust drops fields in declaration order, so pending evidence must precede its owner lease",
+    );
+
+    let core_commit = source_scope(
+        SESSION_SOURCE,
+        "impl<'session, Plan: SessionPlanV1> PreparedSessionTransition<'session, Plan>",
+        "/// The only production owner of revision admission",
+    );
+    for forbidden in [
+        "Result<",
+        "?;",
+        ".evaluate(",
+        "prepare_observation(",
+        "prepare_schema_ordered_observation(",
+        ".map_err(",
+        ".try_reserve(",
+        ".clone(",
+    ] {
+        assert!(
+            !core_commit.contains(forbidden),
+            "commit must remain infallible move-only publication; found `{forbidden}`",
+        );
+    }
+    for required in ["drop(owner);", "*raw_head =", "*state = next_state;"] {
+        assert!(
+            core_commit.contains(required),
+            "commit must publish under the pinned owner; missing `{required}`",
+        );
+    }
+    let owner_release = core_commit
+        .find("drop(owner);")
+        .expect("commit must release its exact owner explicitly");
+    for publication in ["*raw_head =", "*state = next_state;"] {
+        let last_publication = core_commit
+            .rfind(publication)
+            .unwrap_or_else(|| panic!("commit must contain `{publication}`"));
+        assert!(
+            last_publication < owner_release,
+            "every `{publication}` path must publish before releasing the exact owner",
+        );
+    }
+
+    let concrete_prepared = source_scope(
+        PROGRAM_SOURCE,
+        "/// Полностью вычисленный, но ещё не опубликованный переход одной Session.",
+        "impl<'owner, 'session> PreparedSessionTransitionV1<'owner, 'session>",
+    );
+    let concrete_must_use =
+        "#[must_use = \"commit the prepared transition or drop it intentionally\"]";
+    assert_eq!(
+        concrete_prepared.matches(concrete_must_use).count(),
+        1,
+        "the Program wrapper must carry the same deliberate commit-or-drop diagnostic as Core",
+    );
+    assert!(
+        concrete_prepared
+            .find(concrete_must_use)
+            .expect("prepared Program transition must be must_use")
+            < concrete_prepared
+                .find("pub(crate) struct PreparedSessionTransitionV1")
+                .expect("prepared Program transition declaration must remain present"),
+        "must_use must annotate the linear transition itself",
+    );
+
+    let concrete_commit = source_scope(
+        PROGRAM_SOURCE,
+        "impl<'owner, 'session> PreparedSessionTransitionV1<'owner, 'session>",
+        "/// Проверенная Owner-and-snapshot проекция",
+    );
+    assert!(
+        concrete_commit.contains("session: transition.commit(),")
+            && !concrete_commit.contains("Result<")
+            && !concrete_commit.contains("?;"),
+        "Program commit must only project the already committed Session view",
+    );
 
     let staged_access_errors = source_scope(
         PROGRAM_SOURCE,
@@ -656,7 +782,7 @@ fn shared_observation_ssot_has_one_backing_without_lifecycle_or_adapter_facades(
         "fn try_acquire_owner(&self) -> Option<Self::OwnerLease>;",
         "owner: &'a Self::OwnerLease,",
         "SessionUpdateError::OwnerExpired",
-        ".is_same_binding_as(expected_observation)",
+        ".is_same_binding_as(&raw_observation)",
         "SessionUpdateError::EvidenceBindingInvariant",
     ] {
         assert!(
@@ -713,7 +839,7 @@ fn shared_observation_ssot_has_one_backing_without_lifecycle_or_adapter_facades(
             "keyed",
             source_scope(
                 SESSION_SOURCE,
-                "pub(crate) fn update(",
+                "pub(crate) fn prepare_update(",
                 "/// Stream-affine `Unknown` admission",
             ),
             "prepare_observation(",
@@ -722,31 +848,31 @@ fn shared_observation_ssot_has_one_backing_without_lifecycle_or_adapter_facades(
             "schema-ordered",
             source_scope(
                 SESSION_SOURCE,
-                "pub(crate) fn update_schema_ordered",
-                "fn apply_prepared_update",
+                "pub(crate) fn prepare_schema_ordered",
+                "fn prepare_session_transition",
             ),
             "prepare_schema_ordered_observation(",
         ),
     ] {
         let owner_preflight = update
             .find(".try_acquire_owner()")
-            .unwrap_or_else(|| panic!("{name} update must acquire the exact owner generation"));
+            .unwrap_or_else(|| panic!("{name} prepare must acquire the exact owner generation"));
         let schema = update
             .find("let schema = self.plan.observation_schema(&owner);")
-            .unwrap_or_else(|| panic!("{name} update must derive schema from that owner"));
+            .unwrap_or_else(|| panic!("{name} prepare must derive schema from that owner"));
         let admission = update
             .find(prepare)
-            .unwrap_or_else(|| panic!("{name} update must perform canonical admission"));
+            .unwrap_or_else(|| panic!("{name} prepare must perform canonical admission"));
         assert!(
             owner_preflight < schema && schema < admission,
-            "{name} update must pin owner, derive its schema, then admit",
+            "{name} prepare must pin owner, derive its schema, then admit",
         );
         assert_eq!(
             update
                 .matches("let schema = self.plan.observation_schema(&owner);")
                 .count(),
             1,
-            "{name} update must borrow exactly one schema",
+            "{name} prepare must borrow exactly one schema",
         );
         assert!(
             !update.contains("observation_schema(&owner).clone()"),

crates/labcolors-core/src/point_support_tests.rs

@@ -17,6 +17,7 @@ use crate::point_support::{
     PointSupportStabilityDecisionV1, PointSupportStabilityPolicyV1,
 };
 use crate::session::{Session, SessionPlanV1, SessionState};
+use crate::session_tests::CommitSessionUpdateForTest as _;
 use crate::wcag22::Wcag22CriterionV1;
 
 const STREAM: ObservationStreamId = ObservationStreamId::new(31);
@@ -87,7 +88,7 @@ fn point_support_session_owns_exactly_one_canonical_schema_handle() {
     );
 
     let report_schema_ptr = match session
-        .update(observed_update(1, [(1, vec![(SURFACE_A, [0; 3])])]))
+        .commit(observed_update(1, [(1, vec![(SURFACE_A, [0; 3])])]))
         .unwrap()
     {
         SessionState::Ready { current } => current.report().observation().schema_ptr_for_test(),
@@ -103,7 +104,7 @@ fn point_support_session_owns_exactly_one_canonical_schema_handle() {
     );
 
     session
-        .update(observed_update(1, [(1, vec![(SURFACE_A, [0; 3])])]))
+        .commit(observed_update(1, [(1, vec![(SURFACE_A, [0; 3])])]))
         .unwrap();
     assert_eq!(
         session
@@ -168,7 +169,7 @@ fn multi_paint_declared_order_and_direct_provenance_are_preserved() {
 
     let mut session = Session::new(STREAM, requirements);
     let SessionState::Ready { current } = session
-        .update(observed_update(
+        .commit(observed_update(
             1,
             [(9, vec![(SURFACE_A, [0; 3]), (SURFACE_B, [255; 3])])],
         ))
@@ -226,7 +227,7 @@ fn duplicate_raw_scenarios_share_one_physical_case_without_cartesian_expansion()
 
     crate::composition::reset_source_over_evaluation_count();
     let SessionState::Failed { cause, previous } = session
-        .update(observed_update(
+        .commit(observed_update(
             1,
             [
                 // Same complete physical tuple, deliberately repeated with
@@ -349,7 +350,7 @@ fn exact_wcag_and_stability_are_independent_axes_and_baseline_binds_once() {
 
     let mut session = Session::new(STREAM, requirements);
     let SessionState::Failed { cause, previous } = session
-        .update(observed_update(1, [(44, vec![(SURFACE_A, [255; 3])])]))
+        .commit(observed_update(1, [(44, vec![(SURFACE_A, [255; 3])])]))
         .unwrap()
     else {
         panic!("WCAG and stability must fail even though exact identity passes");
@@ -421,7 +422,7 @@ fn exact_wcag_and_stability_are_independent_axes_and_baseline_binds_once() {
     );
 
     session
-        .update(observed_update(2, [(45, vec![(SURFACE_A, [255; 3])])]))
+        .commit(observed_update(2, [(45, vec![(SURFACE_A, [255; 3])])]))
         .unwrap();
     assert_eq!(
         crate::composition::source_over_evaluation_count(),
@@ -458,7 +459,7 @@ fn all_four_wcag_criterion_identities_survive_the_full_support_path() {
     );
     let mut session = Session::new(STREAM, requirements);
     let SessionState::Ready { current } = session
-        .update(observed_update(1, [(1, vec![(SURFACE_A, [255; 3])])]))
+        .commit(observed_update(1, [(1, vec![(SURFACE_A, [255; 3])])]))
         .unwrap()
     else {
         panic!("black on white passes every admitted WCAG criterion");
@@ -520,7 +521,7 @@ fn wholly_inactive_plan_is_rejected_but_an_inactive_composition_cell_is_allowed(
     assert_eq!(mixed.surface_schema(), &[SURFACE_A, SURFACE_B]);
     let mut mixed_session = Session::new(STREAM, mixed);
     let SessionState::Ready { current } = mixed_session
-        .update(observed_update(
+        .commit(observed_update(
             1,
             [(1, vec![(SURFACE_A, [17; 3]), (SURFACE_B, [3; 3])])],
         ))
@@ -608,7 +609,7 @@ fn every_stability_anchor_survives_compile_evaluate_and_typed_evidence() {
     );
     let mut session = Session::new(STREAM, requirements);
     let SessionState::Ready { current } = session
-        .update(observed_update(1, [(91, vec![(SURFACE_A, [255; 3])])]))
+        .commit(observed_update(1, [(91, vec![(SURFACE_A, [255; 3])])]))
         .unwrap()
     else {
         panic!("unchanged black-on-white reference must retain every declared anchor");