Lispex 2.0 specification

The following table fixes the Unicode property operations. Each accepts one character.

The complete Unicode transformation repertoire is fixed below. Its signatures belong to the public procedure catalog.

The data sources are the archived Unicode 17.0.0 files. UAX #44 revision 36 fixes their interpretation and defaults.

Every Unicode scalar is accepted by the appropriate character or string operation. Unassigned, private-use, and noncharacter scalars use the frozen defaults. A later Unicode assignment does not change those defaults. New data, errata, or tailoring require a new language semantics revision. The source grammar defines its own whitespace separately from char-whitespace?.

The call first completes expression evaluation and checks arity. It then checks argument types from left to right. Unicode work starts only after those checks succeed. Type and arity failures are language conditions. Resource exhaustion follows the reservation order. A procedure returns its complete result or the first failure.

The resource event catalog defines these event names, reservation points, and canonical sites. This table selects the events used by each operation.

Coefficients, allocation units, limits, and physical envelopes remain with the cost model freeze.

A scalar property query or simple case mapping performs one scalar scan and one unicode-map. Its map extent is one. For digit-value, that map reserves the complete exact integer representation and value slot before creating the digit result. A nondecimal input returns #f within the same event. Neither result adds a datum-allocate event. Booleans and characters retain their declared scalar representation requirements.

A completed string mapping or normalization reserves one datum-allocate before materializing its immutable result. Its extent is m, the actual number of output scalars. The complete requirements include the string header, value slot, and space for up to 4 times m UTF-8 octets. They also include encoding work and any temporary storage used for materialization. The extent remains m when input length, decomposition capacity, or UTF-8 octet length differs. Extent zero still reserves an empty string result. Refusal publishes no partial string and refunds no earlier charge.

Each procedure takes exactly one string and returns a string.

Chapter 3 sections 3.11 and 3.12 define the algorithms. UAX #15 revision 57 fixes the normalization conformance requirements. They include canonical ordering, composition exclusions, and Hangul decomposition and composition.

The empty string returns the empty string. A normalization procedure neither changes case nor inserts Stream-Safe separator characters. Long combining sequences keep their specified result and consume the declared resource events. Exhaustion stops the operation before a partial result becomes visible.

After the complete original scalar scan and required end, each normalization call performs one unicode-normalize at argument(0). Its extent is the original scalar count n. D is 4 for NFC and NFD, and 18 for NFKC and NFKD. Its complete requirements cover two scalar buffers, each with capacity D times n, and 256 canonical-combining-class counters. Bound arithmetic, decomposition lookup, ordering, composition, and all intermediate storage belong to this reservation. It succeeds before transformation or scratch materialization starts.

Fully decompose the input under the selected form. Use stable counting order within each maximal nonstarter run. A scalar with combining class zero separates runs. Equal combining classes retain their original order. Compose NFC and NFKC in place under the Unicode blocking, exclusion, and Hangul rules. With decomposed length L and r runs of at least two nonstarters, ordering work has the structural bound O(1 + L + 256r). L is at most D times n and r is at most floor(L / 2). Reserve from n, D, and these upper bounds before decomposition; discovering actual L or r is transformation work. The selected model covers fixed workspace setup and every complete lookup, counter pass, scalar visit, and movement, including their coefficients. It cannot hide a recursive walk, comparison sort, or quadratic insertion pass outside the reservation.

The empty string still has one unicode-normalize with extent zero, followed by one datum-allocate with extent zero. The fixed workspace and empty-result requirements remain part of those reservations.

A completed string mapping or normalization reserves one datum-allocate before materializing its immutable result. Its extent is m, the actual number of output scalars. The complete requirements include the string header, value slot, and space for up to 4 times m UTF-8 octets. They also include encoding work and any temporary storage used for materialization. The extent remains m when input length, decomposition capacity, or UTF-8 octet length differs. Extent zero still reserves an empty string result. Refusal publishes no partial string and refunds no earlier charge.

The unary case operations accept one value of the indicated type.

Simple mappings always produce one scalar. A missing mapping returns the input scalar. A product must not truncate a full mapping to implement a character operation.

String case conversion uses Default Case Conversion. It combines UnicodeData.txt with SpecialCasing.txt. It applies unconditional mappings and language-independent conditions, including Final_Sigma. Every context is tested against the original string. Language-tagged mappings are excluded. Case folding excludes status T and uses one pass over the original scalars. The empty string maps to itself.

Each comparison accepts at least two arguments of its own type. After type validation, it folds all arguments from left to right. It then compares adjacent pairs from left to right. For each folded string pair, comparison starts at index zero. At each position, inspect the left sequence and then the right. Decide whether to stop only after both reads. Stop that pair at unequal scalars or an end. The result is true exactly when every pair satisfies the named relation. The first false pair ends comparison. Scalar order is numeric code point order. String order is lexicographic scalar order with the shorter equal prefix first. Comparison does not apply normalization or locale collation.

Let n be the number of original input scalars. Full string mapping first scans all n scalars and the required end. It then maps the original scalars in ascending index order. Each unicode-map has extent n. The first map reserves one scratch buffer with capacity D times n scalars. D is 3 for uppercase, 2 for lowercase, and 3 for folding. That reservation succeeds before either scratch storage or the first mapped scalar is created. Later maps reuse that capacity. They reserve their own mapping work without another scratch allocation. An empty input performs its end scan and result allocation, with no map or mapping scratch reservation.

The map requirement includes exact bound calculation, table lookup, expansion, and retained scalar storage. These counts are mathematical integers. A host word width cannot add a domain limit or change the first failure.

Lowercasing keeps a preceding-cased state while visiting the original scalars. Case_Ignorable scalars leave that state unchanged, including a scalar that is also Cased. Every other original scalar sets the state to its Cased property. A U+03A3 map tests the state before that scalar updates it. If the state is true, inspect the original suffix in ascending index order. Skip Case_Ignorable before testing Cased. The first remaining scalar, or the required end, determines whether a following cased scalar exists. Final_Sigma selects U+03C2 exactly when the preceding state is true and no such following cased scalar exists. Otherwise U+03A3 maps to U+03C3.

The current map includes the preceding-state work and every required suffix visit in its complete requirements. At most n original scalars are visited for that map's context work. These visits create no additional text-scalar-scan events. Earlier mapped results never supply context.

All argument domain checks finish before folding or replacing any retained argument. Fold each argument in ascending argument order. Retain its completed folded value in the same logical operand-sequence position already reserved for that call. A character replacement belongs to its unicode-map. A string replacement belongs to its completed result allocation. This replacement changes no caller binding or immutable input value. It adds no argument-store or traversal-state event and requires no separate descriptor sequence. Every folded value remains available until comparison finishes or the call fails. Repeated references to the same input still perform each argument's full folding schedule and result reservation.

For a unary string transformation, the result allocation site is result(0). For a folded string comparison, the folded result of argument i is allocated at result(i) of the invoking comparison call. The site role is datum-allocate. All scans and maps continue to select the original argument(i) and its scalar positions.

After all folding and retention, each folded character pair performs one compare-scalar. For strings, each visited position performs one compare-scalar. Reserve before reading the left scalar or end, then the right scalar or end at that same position. Both reads belong to that event, including when the left sequence has ended. Only after both reads does the pair stop at unequal scalars or an end. No additional text-scalar-scan accompanies these folded reads. String comparison sites use field(compare), argument(i), scalar(j), where i is the left argument of the adjacent pair and j starts at zero for each pair. Character comparison selects field(compare), argument(i). The first false pair ends comparison after every argument has already been folded.

A program event uses the canonical site bytes. Its role is its exact EventIdentity. The occurrence is the original semantic occurrence. A program identity is attached outside those local bytes.

The first rest pair has index zero. Each following pair has the next index. This path adds no schema field.

Indices are mathematical nonnegative integers. A path selects a semantic component. A host address, source line, temporary register, or fixture label cannot select it. Repeated visits keep the same site. Event order distinguishes those visits. An inlined library call retains the site of its fixed library occurrence.

The resource model receives the operation name, exact input sizes, result shape when known, traversal direction, and selected component. Those parameters determine requirements. They do not create additional events. A rejected event retains its exact name and path.

The following fixed prefixes select implicit calls. They precede the operator, argument, result, or component suffix of every shared call event. Call-return uses the same prefix as call.

Parameter initialization still names its declared binding occurrence. A callback body still uses its own program nodes. The prefix does not become a call stack or a source label.

For a unary string transformation, the result allocation site is result(0). For a folded string comparison, the folded result of argument i is allocated at result(i) of the invoking comparison call. The site role is datum-allocate. All scans and maps continue to select the original argument(i) and its scalar positions.

A folded string comparison uses field(compare), argument(i), scalar(j). Its paired left and right reads have that single site. A folded character comparison uses field(compare), argument(i). A normalization event selects argument(i) once for the complete string transformation.

The evaluation and procedure Rules select the work. This table places reservations around that work.

A module definition uses one sequential binding step. Its result-check requires one value and uses the complete path element(0) on its sequential module group. Adjacent lambda definitions use the Recursive group row.

The result-check in an operator, argument, initializer, test, or receiver context requires one value. It reserves before reading the count. A body or begin does not impose that check on discarded or final values. A result sequence is created by its producing operation and forwarded without copying.

The argument-sequence event creates an empty logical operand sequence. Each argument-store reserves before retaining one completed argument. A failed argument never enters that sequence. Callability and arity remain after every operand. Parameter events follow successful call checks. Frame requirements come from the selected model. The table fixes no frame size. A replaced tail call has no later call-return event of its own.

An implicit call starts with already computed values. It runs argument-sequence and argument-store without reevaluating expressions or adding argument result-count checks. It then runs the ordinary callability, arity, call, and parameter events. This applies to entry, callbacks, named let, and clause receivers. Entry uses its selected lambda occurrence and the entry field path. A named let uses its own node for the implicit closure and parameter environment. No synthetic lambda node is created.

Under the tail-call rule, apply targets and call-with-values consumers inherit the invoking call's tail position. A tail transfer passes the native frame and pending return to the target. The replaced native call has no call-return. The producer and every other library callback remain nontail.

A library callback precheck is a distinct arity-check at the invoking operation. It does not remove the ordinary arity check of a later callback call. This preserves both the empty-input precheck and the complete call contract.

Body and handler tail positions follow the tail-position rule. Deactivating the guard releases its active guard control. The handler result reaches the guard expression's continuation. The enclosing call keeps its pending return when the body fails. A handler tail call replaces that enclosing call's frame. Unmatched clauses follow the guard propagation rule. Unwinding does not refund work or allocation. A terminal resource refusal runs no guard event after the refusal.

For every procedure in the closed library catalog, expand the shared call schedule first. Then expand its domain protocol and its row events in their written order. The specialized constructor and traversal protocols take precedence where the library Rule names them. A row with no later events still performs its shared checks.

Scalar predicates use their argument check as the type classification. They add no fabricated allocation for an already defined Boolean or empty list. A literal event still accounts for exposing a source literal. Numeric event requirements include their exact intermediate storage. A single semantic arithmetic event cannot hide unreserved host work.

Text passes use field(scan), field(map), or field(compare) before the scalar index. A length scan and a later selected-range scan remain distinct visits. Full string mapping scans the complete original input before mapping its scalars. Mapping retains all required contextual work in the named map requirements. Normalization is one semantic transformation event per argument. Its complete intermediate requirement is reserved before transformation. The following allocation event materializes its result.

An exact arithmetic row with several stages does not reserve a later stage before an earlier check. The empty addition, multiplication, gcd, and lcm cases have their declared identity result. They perform no nonexistent reduction step and still perform any result allocation stated by their row.

The list, sequence append, and UTF-8 rows in the library catalog fix the following event boundaries. Make-list repeats traversal-state then datum-allocate for each result index after all domains. Count zero performs neither. List-ref and list-tail perform their full domain spine pass before bounds and the subsequent selected-component walk. List-tail zero performs no later movement.

Vector-append and bytevector-append complete all domains, then read every stored length in argument order, then reserve the complete result, then visit the elements in argument and index order. Every length read and exact total update belongs to its sequence-step requirements. An empty argument has a length event and no element event.

UTF-8 decoding allocates one result scalar after its complete valid byte sequence. Encoding allocates one result octet at a time after its scalar visit. An empty conversion visits its required end before one empty-aggregate allocation. A malformed prefix fails at the byte that first proves it invalid. A missing continuation fails at the required end position. Its ordinary diagnostic payload follows that detecting visit. Bytevector->list reads its stored length once and then reserves each octet integer and result pair in one combined datum-allocate before constructing either.

In these schedules and their examples, a reservation extent is a declared count of semantic components consumed, created, or retained by the operation. A pair has two component positions. A scalar or octet has one. One make-list cursor position has extent one. A combined octet integer and pair has extent three. An aggregate extent is its element count. For a full string map or normalization, extent n counts original input scalars. It does not count scratch capacity or context visits. A Unicode string result extent m counts its actual output scalars. The operation and result shape distinguish these counts. Extents are exact mathematical integers, not allocation tariff units or host storage sizes.

An extent of zero still reserves the complete requirements for the empty aggregate. A null extent in a trace means that no component-count extent applies to that event. It does not omit its reservation or assign zero requirements. Every event reserves its complete requirement vector from its exact semantic inputs and shape. This includes headers, cursor state, exact integer representation, temporary storage, and all work before the effect. Diagnostic-payload uses its complete typed payload and diagnostic codec. These example fields are documentation notation and add no field to a canonical site or public report schema.

A scalar property query or simple case mapping performs one scalar scan and one unicode-map. Its map extent is one. For digit-value, that map reserves the complete exact integer representation and value slot before creating the digit result. A nondecimal input returns #f within the same event. Neither result adds a datum-allocate event. Booleans and characters retain their declared scalar representation requirements.

Let n be the number of original input scalars. Full string mapping first scans all n scalars and the required end. It then maps the original scalars in ascending index order. Each unicode-map has extent n. The first map reserves one scratch buffer with capacity D times n scalars. D is 3 for uppercase, 2 for lowercase, and 3 for folding. That reservation succeeds before either scratch storage or the first mapped scalar is created. Later maps reuse that capacity. They reserve their own mapping work without another scratch allocation. An empty input performs its end scan and result allocation, with no map or mapping scratch reservation.

The map requirement includes exact bound calculation, table lookup, expansion, and retained scalar storage. These counts are mathematical integers. A host word width cannot add a domain limit or change the first failure.

Lowercasing keeps a preceding-cased state while visiting the original scalars. Case_Ignorable scalars leave that state unchanged, including a scalar that is also Cased. Every other original scalar sets the state to its Cased property. A U+03A3 map tests the state before that scalar updates it. If the state is true, inspect the original suffix in ascending index order. Skip Case_Ignorable before testing Cased. The first remaining scalar, or the required end, determines whether a following cased scalar exists. Final_Sigma selects U+03C2 exactly when the preceding state is true and no such following cased scalar exists. Otherwise U+03A3 maps to U+03C3.

The current map includes the preceding-state work and every required suffix visit in its complete requirements. At most n original scalars are visited for that map's context work. These visits create no additional text-scalar-scan events. Earlier mapped results never supply context.

After the complete original scalar scan and required end, each normalization call performs one unicode-normalize at argument(0). Its extent is the original scalar count n. D is 4 for NFC and NFD, and 18 for NFKC and NFKD. Its complete requirements cover two scalar buffers, each with capacity D times n, and 256 canonical-combining-class counters. Bound arithmetic, decomposition lookup, ordering, composition, and all intermediate storage belong to this reservation. It succeeds before transformation or scratch materialization starts.

Fully decompose the input under the selected form. Use stable counting order within each maximal nonstarter run. A scalar with combining class zero separates runs. Equal combining classes retain their original order. Compose NFC and NFKC in place under the Unicode blocking, exclusion, and Hangul rules. With decomposed length L and r runs of at least two nonstarters, ordering work has the structural bound O(1 + L + 256r). L is at most D times n and r is at most floor(L / 2). Reserve from n, D, and these upper bounds before decomposition; discovering actual L or r is transformation work. The selected model covers fixed workspace setup and every complete lookup, counter pass, scalar visit, and movement, including their coefficients. It cannot hide a recursive walk, comparison sort, or quadratic insertion pass outside the reservation.

The empty string still has one unicode-normalize with extent zero, followed by one datum-allocate with extent zero. The fixed workspace and empty-result requirements remain part of those reservations.

A completed string mapping or normalization reserves one datum-allocate before materializing its immutable result. Its extent is m, the actual number of output scalars. The complete requirements include the string header, value slot, and space for up to 4 times m UTF-8 octets. They also include encoding work and any temporary storage used for materialization. The extent remains m when input length, decomposition capacity, or UTF-8 octet length differs. Extent zero still reserves an empty string result. Refusal publishes no partial string and refunds no earlier charge.

All argument domain checks finish before folding or replacing any retained argument. Fold each argument in ascending argument order. Retain its completed folded value in the same logical operand-sequence position already reserved for that call. A character replacement belongs to its unicode-map. A string replacement belongs to its completed result allocation. This replacement changes no caller binding or immutable input value. It adds no argument-store or traversal-state event and requires no separate descriptor sequence. Every folded value remains available until comparison finishes or the call fails. Repeated references to the same input still perform each argument's full folding schedule and result reservation.

After all folding and retention, each folded character pair performs one compare-scalar. For strings, each visited position performs one compare-scalar. Reserve before reading the left scalar or end, then the right scalar or end at that same position. Both reads belong to that event, including when the left sequence has ended. Only after both reads does the pair stop at unequal scalars or an end. No additional text-scalar-scan accompanies these folded reads. String comparison sites use field(compare), argument(i), scalar(j), where i is the left argument of the adjacent pair and j starts at zero for each pair. Character comparison selects field(compare), argument(i). The first false pair ends comparison after every argument has already been folded.

The following expansions complete the traversal reservation positions. They preserve the already adopted validation order. Implicit call positions follow the tail-call rule.

Constructor string-key comparisons scan scalars and compare them in key encounter order. Each new key checks prior keys in their list order. After duplicate checks, one traversal-state establishes the canonical key order. Its requirement depends on the complete key collection. Required-key, supplied-key, and field-value checks then use that canonical order. Portable field data uses datum-validate. No constructor field is truncated.

Traversal workspace belongs to the event that first needs it. A child visit reserves any added logical cursor storage before descent. Finishing a visit can release active cursor storage but never refunds cumulative allocation. Tail traversal does not depend on the host stack. Sharing does not skip validation or comparison visits.

prepare.binding-check retains its individual envelope, shape, identifier, duplicate, and recursive-lambda checks. It never combines them into an implementation-dependent scan. Module definition prechecks still finish before child normalization. Reader lookahead, comments, discarded data, and completed token checks retain every event fixed by Source.

A reader-tree path starts at the module datum. It selects list car and cdr or vector elements in structural order. Shorthand and escape spellings retain their exact source span for preparation failures. Canonical program sites are assigned only after canonical construction.

Source capture charges its actual source span to the preparation input channel once. Decode and read visits retain their work and storage charges without charging the same source octets again. The source span excludes host paths and presentation metadata.

The existing prepared validator fixes the interleaving of record and byte events. This table adds no second read or record boundary. Capture charges the submitted prepared span to the preparation input channel once. Subsequent validation reads keep their work and storage requirements. Fresh typed records run the validation checks that apply to records. They do not fabricate an incoming byte stream.

Export first sizes the selected canonical prepared encoding from its verified records. Each record-sizing step uses prepared.check-record with field(encoded-size). A complete result-channel reservation covers its output span before the first write event. Writes follow the selected resolved or bytecode grammar. A failed preparation or export publishes no new handle or complete artifact.

Requirement functions use the caller-selected trusted preparation model. A resource model identity found inside unverified bytes cannot select the budget for parsing those bytes. A cache can reuse a verified preparation result under its handle contract. It cannot remove evaluation initialization or evaluation events.

Graph and source-map work uses preparation limits. The graph validation order selects the checks. It runs no initialization or entry.

Foreign identity and site byte fields are checked at their graph.check-record event under their imported canonical decoder. Their complete work and workspace are covered by that event. A malformed count stops before its collection. Embedded prepared decoding follows its own exact event boundaries. The surrounding graph end check precedes the later prepared semantic validation stage required by the graph Rule.

Graph capture charges its complete input span once. A nested validated span keeps its capture, work, and allocation events but adds no second input-channel charge for octets already captured by its outer packet. Source reconstruction keeps source decoding and preparation work. Its source spans are already included in the captured source-map input packet.

Graph export from an existing handle projects only its verified records. A supplied source map is checked before it can annotate that projection. Neither graph data nor a source map can replace a handle or a completed outcome. Output is published only after the entire graph or map packet succeeds.

Projection compound records are Header, Module, Dependency, Import, Export, Binding, Node, Group, Clause, and a present internal definition group. Deriving inspection relations from a record belongs to that record's graph.project requirement. Derived display rows add no separately metered events. An absent optional record adds no record event.

Counted IdentityBytes, CanonicalSiteBytes, SourceBundleBytes, and ResolvedPayload fields add no outer record boundary. Their count digits are outer field octets. Embedded prepared payload octets use prepared.read-header and prepared.read-field instead of another graph.read-field event. Its compound and collection boundaries use the existing prepared.begin-record inventory exactly once. Other foreign byte fields use graph.read-field for their octets and graph.check-record for their complete canonical foreign checks.

The sole graph.size-record requirement includes the entire size pass over the verified output structure. The packet boundary is its location. No rendered relation row, optional absent record, host buffer chunk, or serializer loop adds another size event.

A projected Header uses the root module occurrence with field(header). A Dependency, Import, or Export uses its owning module occurrence with field(dependencies), field(imports), or field(exports), followed by its table position as element(i). Every other projected compound uses its own module, binding, node, group, or clause occurrence. A present internal group uses its retained group occurrence. These paths carry the graph.project role.

A mapping comparison is one event, not separate expected-row and supplied-row passes. Missing or misordered rows stop at that expected mapping event. After the last expected row, the final graph.map-check rejects any extra row. Each paired comparison uses the expected occurrence with role graph.map-check. The final check uses the root module occurrence with field(mappings). The sizing and output-reservation events use the root module occurrence with field(packet).

Ingress capture reserves the actual supplied span before copying it. A borrowed span requires exclusive or protected access during capture. Parsing keeps the captured snapshot. It cannot reread mutable host data. Length digits consume ingress work before their value is trusted. A checked count cannot allocate unchecked contents.

IngressLimits names finite work, allocation, input, and diagnostic ceilings from the trusted product envelope. Their numeric values remain under cost-model-freeze. A byte protocol that uses Datum framing for its records still uses ingress events for that outer transport. The nested canonical guest input uses the codec events below exactly once.

A refused logical ingress reservation returns admission and host.envelope. Its contract is the trusted ingress envelope identity. Its reason is unsupported-limits. Failure to secure that envelope before parsing uses physical-capacity. Neither refusal creates request identity, a canonical evaluation outcome, or an evaluation receipt. A product returns the complete refusal report when the reserved terminal area remains available. An actual loss of host infrastructure remains a host failure.

Normal egress follows one order: measure the complete candidate record and its fields, reserve the complete output, allocate its physical backing, write all octets, then publish. Each egress.measure precedes its sizing effect. Visit a record before its fields, fields in unsigned UTF-8 wire key order, and each field before its nested record value. Visit vectors in index order. An already retained, validated bytevector packet contributes its exact stored length. Other packet inspection or sizing requires previously secured host work. A cached packet length never skips the normal candidate's named record and field measurements. Lengths and intermediate sums use exact nonnegative integers. Host address width changes neither the size nor the traversal.

Before conversion or measurement, secure finite host conversion workspace from the admitted bounds. It covers traversal and ordering state, metadata conversion, exact size arithmetic, and any required nested-packet sizing. Its effects still follow their declared host reservations. Conversion work remains charged to its host account. The workspace is separate from the physical output buffer and borrows no guest evaluation or result capacity.

After every record and field measurement succeeds, egress.reserve-output atomically reserves the complete output span and remaining host requirements. Successful reservation permits physical output allocation. Each egress.write-byte then reserves its work before writing that octet. It does not charge the reserved output octets again. egress.publish follows the last successful byte write and publishes one complete packet. A refused measurement or output reservation performs none of its effects or later steps. Physical allocation or writing failure publishes no normal packet prefix. Previously committed charges remain; discarding an unpublished candidate gives no refund.

Logical output bounds are admitted before ordinary operation work, as required by the channel-forms Rule. An insufficient logical bound is an admission refusal there. It cannot become a new admission failure after evaluation. A later physical allocation failure is a host failure and preserves completed data. Normal output allocation and writing retain the separately secured emergency support.

EgressLimits names finite work, allocation, output, and diagnostic ceilings. Their values remain under the cost model freeze. The host secures support for the admitted output bounds before execution. Wrapper bytes, package metadata, localized text, and command framing never spend the guest result channel. A host output failure preserves every already completed language outcome and receipt eligibility. It is reported through the existing host transport contract and the reserved terminal representation.

The canonical Datum grammar and validation order apply unchanged. These events supply their reservation positions.

The input boundary uses the selected entry lambda occurrence when a verified program is available. Before request identity creation it remains a program-local site with no request identity. A transport or preparation report without a verified program uses its operand and byte coordinates. It cannot fabricate a qualified program site.

The first missing octet attempt still has its work reservation. It consumes no input octet. Every consumed input packet octet has one input-channel charge. Packet boundary and end checks do not consume another octet. Codec traversal state uses logical allocation, not guest call-frame capacity.

All structural and canonical validation finishes before decoded Datum materialization. No announced length allocates a result container before that validation. Materialization reserves the parent node before descending to its children. Physical assembly may differ without changing these events.

Encoding validates the Datum before its size pass. An entry's complete result validation supplies that check. Standalone encoding runs the same datum-validate traversal. The size pass precedes the complete result-channel reservation for evaluation output. Record admission uses the profile report axis for its conversion output instead. Its profile-report reservation covers the complete packet before emission. Output octet events keep their work requirements without charging that channel a second time. No result bytes are published until all emission events succeed.

Host record key ordering reserves the whole ordering operation before it starts. Its requirement depends on the complete name collection. Native enumeration and sorting algorithms add no semantic events. Host record adaptation and its output encoding use the profile host account and yield canonical input bytes. It never adds conversion events to the base evaluation stream. The evaluator then decodes those canonical bytes once under EvaluationLimits. An already canonical association list follows that same evaluation stream. Profile-only checks retain the profile host account.

diagnostic-payload belongs to the account that performs the failed check. Its site keeps that occurrence and component path with role diagnostic-payload. It reserves the complete typed diagnostic payload and any required internal Condition storage before construction. The selected diagnostic codec determines its exact payload octets. All fields remain complete.

Before canonical input acceptance, payload exhaustion uses admission and input.resource. After acceptance it uses evaluate and resource.exhausted. Preparation payload exhaustion uses prepare and resource.exhausted. The stage keeps the interrupted preparation or evaluation stage. These are the existing diagnostic identities.

The emergency terminal representation uses no new guest reservation. Its finite area is secured before the corresponding work begins. Human rendering and optional trace are separate from committing the canonical first cause.

The failure stage follows the operation that was interrupted. Diagnostic-payload keeps that stage.

Profile and ingress work keep their own host phase and account. They do not acquire a canonical evaluation outcome by using the same payload construction protocol.

The report contract defines DiagnosticPayloadBytes. The diagnostic channel counts that complete packet. The outer report and command framing use the host envelope.

The input Datum count includes its magic, payload length, tag bytes, and every field byte. A failed attempt to read beyond the captured end charges work but no absent octet. Source, prepared, and graph captures charge their whole span once. Nested validated spans retain their work and storage events without a second input charge.

The successful result packet is atomic. Its full result-channel reservation precedes allocation and emission. Later codec-byte events charge their work without charging output octets again. A failed encoder publishes no successful result prefix.

Artifact metadata, package records, command framing, and delivery buffers belong to the trusted host transport envelope. They cannot change evaluation channel counts. The host secures those finite envelopes before performing the corresponding work. Normal report and command encoding follows complete record/field measurement, output reservation, physical allocation, byte writing, and publication. The boundary event Rule fixes that order. Prepaid finite conversion workspace belongs to the host account. Neither conversion workspace nor wrapper output debits the guest result account. A logical egress envelope refusal occurs during admission from the complete admitted bounds. It cannot become a new admission failure after a language value or cause has committed. A later physical or delivery failure retains the completed outcome and its receipt eligibility. Host record adaptation produces canonical input bytes under its separate host work contract. The evaluator then processes those bytes by the same input schedule as any other canonical input.

Channel octets are distinct from logical allocation units. This Rule selects no tariff coefficient, allocation size, default limit, representation maximum, or physical envelope. Those values remain under cost-model-freeze.

EmergencyTerminalBytes is one canonical lispex.datum/2 packet. Its root is the closed record below. A record is an ordinary proper association list of dotted pairs. Keys are strings in unsigned UTF-8 order. Byte fields are bytevectors. Every field is required. Unknown fields, duplicate fields, and noncanonical order are rejected.

The identity bytes use the identity contract. Unknown identities use false. No guessed digest, local handle number, source label, or self digest is allowed. A request identity appears only after canonical input acceptance. The enclosing report keeps the existing outcome and receipt eligibility rules.

NatText is the exact nonnegative decimal string from the diagnostic field grammar. InputOperand uses the existing diagnostic enum. A missing octet uses the attempted end offset. A source coordinate uses the immutable submitted module. The surrounding preparation report binds that source submission. A program location requires a verified program identity in the outer program field.

CanonicalSiteBytes is the program-local site record. Program and request identities stay outside that record. A failure path is retained in full. Repeated visits do not add a counter or call stack to it.

The cause bytevector decodes to the already committed phase, code, and typed data. The original diagnostic codec remains fixed. A consumer checks that imported payload under its canonical decoder. Emergency wrapping cannot repair it. A malformed product observation remains an engine defect under the existing diagnostic contract.

Source offsets start at zero in the exact immutable module source. The event retains this coordinate before inspecting its target. No final report rescans source to find it.

A failed check that has no selected module-source target uses wire or none. A failed reservation and its later diagnostic-payload event keep the retained target coordinate. The diagnostic-payload role does not move the original source target.

Wire offsets start at zero in the complete named immutable public operand. That operand includes its public packet header. The following table selects the base.

Selecting a public operand is part of the host request grammar. A nested foreign field does not select a new operand. The parser retains each nested bytevector's payload base while reading it. It adds that retained base to a nested decoder offset. An embedded prepared failure therefore uses its exact position in the selected artifact or graph packet. Count and field checks use the first octet of that field. Compound checks use the first octet of that record. Final end checks use the complete operand length. A missing field uses the attempted end offset. These offsets require no postfailure copy, scan, or digest.

The none location is allowed only when the operation has not selected a program site, source target, or wire operand coordinate. Its typed diagnostic data still preserves any command argument or host field identity.

The host determines a finite bound before starting the corresponding work. These names denote bounds supplied by the selected resource and transport model. They do not assign numeric values.

EmergencyTerminalBound is the maximum encoded length over those admitted fields. EmergencyFramingBound includes every required outer field and delimiter. It also covers retained outcome and receipt packets, completed report slots, and separate trace framing. The command envelope fixes their fields. The terminal core is the smallest closed EmergencyTerminalBytes record for its admitted fields. Complete record framing embeds that exact core in Reports.terminal and supplies every required CommandResult field. Copying a prebuilt core into retained framing and writing the framing directly must produce the same canonical bytes and preserve the same data and cause. A channel requiring CommandResultBytes receives that complete record, not a bare terminal core.

Terminal backing, framing backing, EmergencyCursorBound, and EmergencyWorkBound are secured before the first normal operation. Ordinary work begins only after all four requirements succeed. Byte capacity alone is insufficient. Cursor growth, metadata conversion, size arithmetic, backing growth, and all work after refusal fit the secured support. Emergency serialization requires no postfailure acquisition, normal egress retry, or guest reservation. These bounds borrow no guest work, allocation, input, result, or diagnostic capacity. Their numeric values and physical representation remain under cost-model-freeze.

Before request identity exists, the trusted ingress envelope and selected input limits bound the report. Before source or prepared work, the preparation envelope bounds it. Before admitted evaluation, the verified program and EvaluationLimits bound it. Profile work and host output retain their own finite emergency support.

A phase is not admitted when terminal backing, framing backing, cursor state, or serialization work support cannot be secured. No ordinary phase event begins. Partial support never counts as a complete reply. The existing admission/host.envelope diagnostic with reason physical-capacity reports that inability when an already available reporting boundary can produce a complete refusal. An actual loss of host infrastructure remains a host failure. The host never silently lowers a requested semantic limit.

Emergency serialization reads only bounded metadata and already retained diagnostic bytes. It cannot traverse guest data, format a new message, or invoke guest code. The failed event's path is already represented in the reserved location state. Resource reporting uses its closed diagnostic fields. The emergency area is written once for that phase's committed terminal cause. Before entering the failing work, the host binds retained payload, receipt, completed report slots, standalone evidence, and trace to the same immutable operation. Emergency framing consumes those retained bindings without postfailure rehashing, revalidation, or discovery.

If a guest Condition has already committed, its payload remains complete even when later human expansion or transport fails. If diagnostic-payload itself was refused, the core records that resource refusal. An ordinary diagnostic limit can be zero and the reserved terminal representation still exists. This does not grant ordinary diagnostics extra capacity.

A later qualification, evidence, trace, or delivery failure keeps every completed report slot, primary payload, receipt packet, and completed trace snapshot. A trace still in progress follows its existing reservation, saturation, and footer rules until its snapshot completes. Incomplete normal report slots remain absent. Emergency framing keeps every completed slot within its secured bound. The completed language outcome and receipt eligibility remain unchanged. An emergency payload alone creates no evaluation receipt.

A completed language failure keeps outer status 20; a completed resource stop keeps outer status 21. A later qualification or evidence refusal preserves that exact status, including when normal profile reporting fails and requires emergency framing. The later phase retains its own first refusal in its report or terminal payload. The completed evaluation diagnostic, qualified site, outcome bytes, and receipt bytes remain unchanged. Status selection uses retained evaluation classification without reparsing the receipt or inferring it from the emergency diagnostic. The profile contract still determines which later work is performed. This framing rule adds no returned-Datum schema traversal after failed evaluation. Physical delivery and packet replacement follow the command result contract.

The following reservation names belong only to the trace account. They are not guest EventIdentity values and are not traced recursively.

Trace work is reserved before metadata inspection. The measure reservation checks work and allocation atomically before that bounded scan or its workspace. Frame calculation reads no guest payload. The remaining record reservation checks work, allocation, then capacity. It commits those requirements atomically. Earlier successful trace work is not refunded if that reservation fails.

The stored record unit is the complete TraceRecord byte span. It is not an event count, guest work unit, UTF-16 count, or unframed payload size. The marker and every length digit count. The header and footer also consume capacity. A record fits when its total leaves exactly the reserved footer capacity. A rejected record contributes no bytes.

If the header and footer cannot fit, no TraceBytes value is created. The separate host trace status reports unavailable. The requested language evaluation retains its original request and limits. If trace is not requested, the host reports disabled and creates no trace state.

Once a stream is open, a work, allocation, or capacity refusal marks its reserved footer with completion 01. Every later observation is ignored. A complete stream uses completion 00. Host interruption before Terminal uses completion 02 unless saturation already fixed completion 01. A stored Terminal keeps completion 00 despite later delivery failure.

The only separate host trace status values are disabled, unavailable, complete, capacity-exhausted, and host-interrupted. Complete and interrupted streams still use their exact TraceBytes encoding. Status metadata is not part of the canonical evaluation outcome or receipt.

Trace storage may be provisioned before input decoding. Recording begins only after canonical input admission supplies the verified program and request identities. It begins before module initialization. Input decoding before request identity and later profile or transport work remain outside that stream.

Trace requirement coefficients, allocation units, finite defaults, maximum capacity, and physical backing remain under cost-model-freeze. No implementation-specific chunk size is selected.

The capacity-exhausted status names a stopped recording account. It does not select a guest resource axis. Status metadata remains separate from the complete trace packet and the semantic result.

The tables use the domains below. Arity counts supplied arguments. A trailing plus in an arity admits every greater finite count.

Scalar and Datum domains use the Values definitions. A vector or list may contain a procedure internally. That aggregate then fails the Datum predicate and portable boundary validation.

All constructors create immutable values. Constructors with a count require an explicit fill value. Empty construction still validates every supplied argument. Counts have no host word limit. Finite work and logical allocation govern construction.

Each listed procedure returns one value unless its row specifies an internal result sequence or no normal result. The values, apply, and call-with-values procedures can return any finite count of internal values.

Arithmetic uses exact numbers. Successful results are integers or reduced rationals. Arithmetic never preserves a display scale.

Variadic addition starts from zero. Variadic multiplication starts from one. Subtraction and division start from their first operand when more than one is supplied. Each proceeds from left to right. A unary division checks its sole operand as the divisor. A longer division checks every operand after the first as a divisor.

All numeric argument domains are checked before zero-divisor checks. The zero-divisor checks finish in argument order before arithmetic begins. An earlier zero, false comparison, or selected minimum does not skip a later argument check.

The remainder has the dividend sign when nonzero. Modulo has the divisor sign when nonzero. Both return zero as the integer zero. The gcd and lcm results are nonnegative. The power with exponent zero is one, including zero raised to zero. The expt catalog row defines the failure for a zero base with a negative exponent.

Quantize and the unary rounding procedures use the complete rounding grid, mode, and check order contracts.

The number->string procedure uses the canonical text forms below. Its arity is exactly one. It performs no rounding or locale formatting.

The rational form has a nonzero numerator and a denominator greater than one. Source decimal spelling never changes this text.

Indices count elements from zero. Strings count Unicode scalars. Bytevectors count octets. They use exact integer indices independent of host width.

Reference operations require an index below the length. List-tail also admits the length and returns the empty suffix. A slice admits endpoints from zero through the length. Its start is included and its end is excluded. Slice checks run after argument domains. They check start bounds, end bounds, then start order. A start greater than end produces domain.range with invalid-slice-order on the ending bound argument. Equal endpoints return an empty sequence of the same kind.

String-length, string-ref, and substring first scan the entire input in scalar order to establish its length. String-ref checks bounds after that scan, then scans from the start through its selected scalar. Substring checks both bounds and start order after the length scan. It next visits scalar indices from zero up to but excluding end. It copies indices from start up to but excluding end. Metadata length caches preserve these scan events.

Vector and bytevector length checks read their stored element count through sequence-step. An indexed call reads that count once for its bounds checks. A successful reference then visits its selected element. A successful slice visits its selected elements in ascending index order after allocation. Each slice endpoint must satisfy 0 <= endpoint <= length before checking start <= end.

Append accepts only proper lists. It returns a proper list even when given no arguments. Member validates its needle and every list element as Datum before comparing. Assoc validates every entry pair and Datum key before comparing. Missing matches return #f. Search uses structural equality and stops at the first matching element or key.

Raw string and symbol comparisons inspect exact scalar sequences. String order is lexicographic scalar order with the shorter equal prefix first. Character order is numeric scalar order. Every argument type is validated before a comparison can return false.

Each adjacent string or symbol comparison starts at scalar index zero. It inspects the left position before the right position. Raw comparisons emit text-scalar-scan for each scalar visited. A paired comparison emits compare-scalar and stops that pair at its first unequal scalar or its first sequence end. Sequence ends supply the shorter-prefix comparison. The next adjacent pair begins only when the required relation holds. Otherwise the procedure returns false. Folded comparisons use the same paired positions after all folding work. Their paired visits use compare-scalar.

Unicode operations apply the fixed Unicode 17.0.0 repertoire. The normalization and case algorithms supply their complete mappings. Folded comparisons transform all arguments before comparing adjacent results.

The UTF-8 conversion procedures preserve every scalar. The bytevector contains only UTF-8 text bytes. Encoding uses the shortest representation and adds no marker. Decoding retains U+FEFF even at the start. It rejects overlong forms, isolated continuation bytes, truncation, surrogates, and scalars above U+10FFFF. Unassigned scalars and noncharacters remain valid data.

The decoder scans from the start. Each byte check rejects as soon as the inspected prefix cannot begin a valid shortest UTF-8 scalar. This includes the second-byte bounds imposed by E0, ED, F0, and F4. The first such check produces domain.range with invalid-utf8 on the bytevector argument. Its detection site is that byte's sequence-step, even when an earlier byte began the sequence. If a required continuation is missing, the detecting visit uses the next required byte index at the input end. The diagnostic-payload event keeps that occurrence and path with its own role. The Condition retains its existing fields and carries no byte position. It never substitutes replacement text. These procedures run during evaluation and their domain failures are ordinary language conditions. A result appears only after the complete conversion succeeds.

The six condition procedures use the Condition catalog. That catalog defines their internal value, field schemas, constructor order, accessors, and raised occurrences. The public rows here select their signatures and resource events. The constructor applies the imported validation order after ordinary operand evaluation and its arity check. Resources defines each selected event and reservation point.

The following table defines type predicates.

The following table defines booleans and equality.

The following table defines exact arithmetic.

The following table defines pairs and lists.

Make-list completes both argument domains before construction, including when count is zero. For each result index i, it reserves one logical cursor position with traversal-state at result(0), element(i). It next reserves and creates that pair with datum-allocate at the same component path. Their extents are one retained position and two pair components. The next index starts only after that pair allocation succeeds. Count zero returns the empty list without either construction event. Counts remain exact mathematical integers.

List-ref and list-tail first complete the entire L domain, including its final tail. They next check the index domain and reserve a separate argument-check for its bounds. After successful bounds checks, each actual cdr movement emits list-step at the reached cdr path. List-ref then emits one list-step at the selected car path. List-tail returns the reached suffix directly. Index zero therefore adds no movement event for list-tail and only the car visit for list-ref. Neither operation adds a separate endpoint visit after this walk.

The following table defines list traversal.

The following table defines vectors.

Vector-append completes every argument domain before its length pass. In argument order it emits sequence-step at argument(i), field(length) before reading each stored length. It computes the exact total within those reserved steps. It then reserves and creates the complete result at result(0), with extent equal to that total. Only then does it visit the elements of each argument in ascending index order. Empty arguments retain their domain and length events but have no element visits. With no arguments, the only row event is datum-allocate at result(0) with extent zero. The bytevector-append row follows the same two passes with byte component paths.

The following table defines bytevectors and utf-8.

Bytevector-append uses the length and element passes defined with vector-append. Its allocation extent is the exact total octet count. Its element visits use argument(i), byte(j). Empty arguments still participate in the length pass.

Bytevector->list emits sequence-step at argument(0), field(length) once after its domain check. It then visits each octet at argument(0), byte(i) in ascending index order. Each visit is followed by one datum-allocate at result(0), element(i). That event reserves the complete exact integer and pair together before creating either. Its extent is three, comprising one integer component and the pair's two components. The next byte is visited only after that combined event succeeds. A zero length returns the empty list after the length visit with no component allocation or extra end visit.

UTF-8 conversion uses sequential input visits through the required end. Decoding visits bytes at argument(0), byte(i). As soon as one complete valid scalar is known, datum-allocate at result(0), scalar(j) reserves that result component with extent one. It finishes that allocation before visiting the next byte. Encoding visits scalars at argument(0), field(scan), scalar(i). It then reserves each encoded octet separately at result(0), byte(j), with extent one, before visiting the next scalar. Output indices increase across the complete result.

A successful nonempty conversion visits its required input end after its last component allocation. It adds no final allocation event. An empty conversion first visits byte zero or scalar zero as its required end. It then emits exactly one datum-allocate at result(0) with extent zero for the empty aggregate. Each input visit reserves all decoding or encoding work and temporary storage for that visit. The first result allocation includes the aggregate header and storage required for that component. Every later allocation includes its complete component and growth requirements. These extents use the library reservation convention.

The following table defines strings and symbols.

The following table defines characters.