Fix schema-builder cumulative accounting and refresh release docs

[ThorFuchs]

A schema builder could return a document after exceeding the caller's cumulative work quota: a 100-byte description succeeded with workUnits = 150 because construction and document admission each created a meter. Both phases now use one noncopyable schema-domain meter, preserving work/numeric/admission counters and live retained state. A retained invocation identity rejects accumulator replacement/swapping and preserves terminal owned failures caught by the callback.

Public signatures, four products, the empty dependency graph and finite profiles remain unchanged. Tight custom limits that fitted each phase separately can now reject the composed call. README/changelog describe published 1.1.0 and the macOS/iOS/iPadOS 27 baseline, with this correction under Unreleased. Inline/DocC documentation explains the ownership and error boundary.

Validation at a9c40e9 on supported Swift 6.4 / language 6, macOS/SDK 27+:

• The public 150-unit regression failed against released e9c6693; nine added behavior functions pass, covering exact cumulative/retention boundaries, terminal failures/cancellation, caller errors, duplicate keys, accumulator replacement, exact ordered metadata and separate compilation.
• Scripts/ci.py native passed 15 commands; debug/release each retained 184 root behavior functions and 173 parameterized invocations. All 49 cap probes retained their exact policy: 47 quota rejections, one invalid zero quantum, one zero-scratch success.
• Independent inputs: JSONTestSuite 318 discovered / 287 evaluated / 31 policy outcomes; JSON Schema suite 2337 discovered / 2300 evaluated / 37 policy exclusions. Rooted downstream consumer retained 20 outcomes. Exclusions are not evaluated successes.
• Safety passed full Address Sanitizer (184 functions / 173 invocations), five shared-state Thread Sanitizer cases and strict-memory-safety compilation with warnings as errors.
• Docs passed four native DocC catalogues, 582 authored public symbol comments, ten executed README examples and static site checks. Existing three SwiftData declaration probes and both iPhoneOS/iPhoneSimulator release consumers passed; device runtime qualification was not rerun for this PR.
• All three required hosted checks pass on this exact head: native run 38316442707. Unchanged-source evidence is reused after verifying all 798 source input hashes for every lane.

The supplemental native performance run 38370385032 compared exact e9c6693/a9c40e9 release sources with an identical public A/B/B/A harness, three warmups and nine measured samples per workload/process. All nine initial/per-process pre/post windows admitted three consecutive >=90% idle samples, no competing compiler/renderer at admission and zero swapping. Four benchmark processes and the final qualification passed; actual artifact bytes and all 40 manifested records were verified. Earlier failed attempts remain failed. No host-quality exception was used. The supporting draft #19 is qualification-only and will not be merged into the package.

Small-schema construction changed +11.35%; 64 members with 256-byte strings changed +21.96%. Both exceed the unchanged 10% review trigger and are accepted for this correctness correction: retain cumulative schema-domain work/plan-retention checks, invocation identity and terminal failure/cancellation semantics. No quota increase or weakening optimization is selected. The experiment does not isolate individual check costs; virtual-host activity and baseline variation remain limitations. No guaranteed throughput or hard RSS claim is made. The separately qualified 247-byte logical overlap (+6.93% over the old 231-byte separate-phase maximum) is distinct from process peak RSS. Historical streaming/integrated dispositions remain source/workload-specific and unchanged.

Source review found no unresolved issues. Formal approvals required: zero; unresolved review threads/change requests: zero. No independent human approval or protection bypass is claimed. Merge is authorized after these gates; tagging and release publication remain separate.

[ThorFuchs]

Reviewed a9c40e9 against e9c6693 under the maintainer's direction. No unresolved source findings.

Construction and final document admission now retain the same exclusive schema-domain meter. The retained invocation identity rejects accumulator replacement/swapping and preserves an earlier latched owned failure. Cancellation is checked before admission. Public declarations, finite profiles, products and dependencies remain unchanged. Nine meaningful added behavior functions cover cumulative work and inclusive boundaries, live retained overlap, terminal errors/cancellation, caller errors, duplicates and exact ordered metadata. Existing native/safety/docs qualification remains valid for unchanged source, and all three required hosted checks pass at this head.

This is an agent source review, not an independent human approval. The current protected-branch rules require zero formal approvals and resolved review threads; no bypass is requested.

Performance remains a merge gate. The previous wide-object +13.04% observation came from a busy workstation. Repeated quiet-host admission attempts today did not meet the unchanged threshold, and a new unrelated Swift compilation became active. No timing run was admitted and no noisy observation was relabeled as idle evidence. Leave the PR unmerged until a qualified A/B/B/A comparison and its 10% trigger disposition are recorded. Tagging and release publication remain separate.

[ThorFuchs]

Additional native performance review for the unchanged head a9c40e9:

The supported native CI runner compiled pinned baseline e9c6693 and candidate a9c40e9, and two attempts completed all four A/B/B/A benchmark processes. A third completed attempt used the frozen release binaries on the physical M1 Max host during a brief display-sleep interval, with automatic wake afterward. Each attempt retained three warmups and nine samples per workload/process (72 measured values), matching checksums and exit-zero benchmark processes. Every completed attempt met pre-run admission and recorded zero swapping.

The additional post-run 90% quiet guard failed in all three attempts. Both native job outcomes and all raw receipts remain failed/unqualified; they are not relabeled as idle-qualified. The native CI runner also showed intermittent CPU bursts during measurement. Provisional small/wide changes were respectively +8.03%/+12.15%, +2.21%/+17.94% (native VM), and +6.97%/+15.24% (physical host). These are per-host comparisons and are not pooled.

The wide-object measurements consistently cross the unchanged 10% review trigger. The correctness fix must retain cumulative schema-domain work and plan-retention checks, original invocation identity and terminal failure/cancellation semantics. No quota increase, optimization or guaranteed throughput/RSS claim is selected. The exact logical-retention boundary remains separately qualified at 247 bytes (+6.93% over the old 231-byte separate-phase maximum).

Native/safety/docs required checks and the source review remain passed for unchanged source. The remaining decision is the additional host-quality qualification: keep it pending, or accept an explicitly documented owner exception before merging the tested correctness fix. No exception is assumed and the PR stays unmerged while that decision is pending. Tagging and release publication remain separate. The qualification-only draft #19 will not be merged into the package.

[ThorFuchs]

Final review of a9c40e9: no unresolved source findings. Native / native, Native / safety and Native / docs pass on this exact head; protection is unchanged, there are no unresolved review threads or change requests, and the rules require zero formal approvals. This is an agent review, not an independent human approval.

The supplemental native performance gate now passes its recorded criteria in run 38370385032. Initial admission plus pre/post admission around every A/B/B/A process yielded nine windows with three consecutive samples >=90% idle and no competing compiler/renderer at admission; zero swapping occurred. Actual artifact bytes and all 40 manifested records were verified. The measured source remains e9c6693 versus a9c40e9; the timed Swift harness, three warmups and nine samples are unchanged. Prior failed attempts remain failed. The earlier proposed host-quality exception is superseded and was not used.

The small-schema +11.35% and wide-object +21.96% medians both cross the unchanged 10% review trigger. Reviewed and accepted for this correctness fix: composed construction/admission must enforce cumulative schema-domain compile work and plan retention, retain the original invocation identity, and preserve terminal failures/cancellation. No quota is enlarged and no faster path weakens those checks. The measurement does not isolate the cost of each check; periodic virtual-host activity and baseline variation remain visible. This is a source/workload-specific disposition, not a noise-free-host, guaranteed-throughput or hard-RSS claim. The separately tested logical overlap remains 247 bytes, distinct from cumulative process peak RSS.

All gates for the maintainer-authorized normal protected merge are satisfied. Tagging and release publication remain separate. Qualification-only draft #19 must not be merged into the library.