Add bounded exact arithmetic to the Swift-JSON CLI

Documentation/Architecture/ExtractionManifest.json

@@ -209,5 +209,8 @@
     "framework_boundary": "Conditional CoreTransferable/UniformTypeIdentifiers plus a narrow explicit main-actor Apple PDF boundary using WebKit, CoreText, CoreGraphics and AppKit/UIKit paragraph styles. Core JSON imports none of these; no new root dependency.",
     "rtf": "Original bounded strict-token emitter; AppKit/UIKit native decoding only in tests and qualification consumers, not generation.",
     "pdf": "Original invocation-owned lifecycle, finite adapter accounting and visible-range pagination using Apple SDK APIs. PDFKit is independent qualification only; no third-party renderer adapted."
-  }
+  },
+  "original_notes": [
+    "1.4 C3 decimal magnitude, rational/quantization kernel, pull range and type-directed overloads are original Apache-2.0 code. The 738-case deterministic oracle uses Python integer/Fraction arithmetic; no jq/Rhoe arithmetic implementation was copied."
+  ]
 }

Documentation/Architecture/Release1.4/Acceptance.json

@@ -1,7 +1,7 @@
 {
   "schema": "swift-json-cli-acceptance/1",
   "prepared": "2026-10-14",
-  "implementation_status": "Foundation and pull query-core milestones; complete C0-C5 integration remains unqualified",
+  "implementation_status": "Foundation, query core and exact arithmetic milestones; C4/C5 integration remains unqualified",
   "requirements": [
     {
       "id": "CL001",
@@ -670,14 +670,18 @@
       "title": "Exact add/subtract/multiply",
       "verification": "Carry/borrow/sign/zero/large integer cases against independent exact expectations.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "Cartesian-add-order",
         "exact-large-integer",
         "exact-decimal-add",
         "exact-borrow",
         "exact-multiply"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -686,20 +690,28 @@
       "title": "Numeric admission and lexemes",
       "verification": "Computed values normalized with no false originalLexeme; untouched inputs preserve spelling.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
-      "fixture_ids": []
+      "fixture_ids": [],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
+      ]
     },
     {
       "id": "CL047",
       "gate": "C3",
       "title": "Terminating exact division",
       "verification": "Reduced denominators containing only2/5, large common factors and mixed signs.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "terminating-division"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -708,10 +720,14 @@
       "title": "Repeating division default",
       "verification": "1/3 and repeating values give language inexactDivision; no floating fallback.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "repeating-division-error"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -720,12 +736,16 @@
       "title": "Explicit scale/half-even",
       "verification": "Required option pair, decimal places, finite caps, signed ties and report rounding counts.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "rounded-third",
         "half-even-ties",
         "scale-pair-required"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -734,11 +754,15 @@
       "title": "Zero division and integral remainder",
       "verification": "Typed catchable domain errors; signed truncated remainder; fractional remainder rejected.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "negative-remainder",
         "fractional-remainder-rejected"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -747,12 +771,16 @@
       "title": "Exact numeric builtins",
       "verification": "abs/floor/ceil/trunc/round/range/add with negative and empty/domain cases; round ties away from zero.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "round-away-from-zero",
         "range-negative-step",
         "range-zero-step"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -761,10 +789,14 @@
       "title": "Exponent/growth preflight",
       "verification": "Large sparse exponent operations fail finite caps before dense allocation; exact zero shortcut allowed.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
       "fixture_ids": [
         "exponent-gap-cap"
+      ],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
       ]
     },
     {
@@ -773,29 +805,41 @@
       "title": "Numeric work and cancellation",
       "verification": "Charged GCD/division/carry inner loops; boundaries and checkpoint cancellation; terminal errors not catchable.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
-      "fixture_ids": []
+      "fixture_ids": [],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
+      ]
     },
     {
       "id": "CL054",
       "gate": "C3",
       "title": "32-bit arithmetic safety",
       "verification": "No Int/UInt64 negation/narrowing/product overflow traps; wasm32 kernel tests or explicit gate blocker.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "partial",
       "evidence_required": true,
-      "fixture_ids": []
+      "fixture_ids": [],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
+      ]
     },
     {
       "id": "CL055",
       "gate": "C3",
       "title": "No Decimal/Double authority",
       "verification": "Source audit plus precision cases prove no foreign arithmetic/fallback authority.",
       "obligation": "mandatory",
-      "status": "not_run",
+      "status": "passed",
       "evidence_required": true,
-      "fixture_ids": []
+      "fixture_ids": [],
+      "evidence": [
+        "Documentation/Architecture/Release1.4/Arithmetic.md",
+        "Documentation/Architecture/Release1.4/Qualification.md"
+      ]
     },
     {
       "id": "CL056",

Documentation/Architecture/Release1.4/Arithmetic.md

@@ -0,0 +1,59 @@
+# Exact filter arithmetic
+
+C3 builds on query core 6e8f145 / draft PR #24. Original private code implements
+base-ten unsigned working magnitudes plus native sign/coefficient/exponent values.
+No Double, Float or Foundation Decimal is an arithmetic authority. Numeric binary
+operators clear originalLexeme and normalize computed zero. Untouched selected
+values preserve their admitted spelling; null's identity overload selects a value.
+
+Addition bounds exponent alignment before dense storage. Schoolbook multiplication
+uses UInt16: digit product + stored digit + carry <=99; addition <=19. Subtraction
+fits Int16. Long division maintains r<divisor before consuming the next digit, so
+a quotient digit is <=9. GCD reduces exact rationals; only 2/5 denominator factors
+produce a default finite decimal. Repeating division raises catchable inexactDivision;
+zero division and fractional remainder are distinct catchable domain errors.
+All loops spend numeric work, including normalization, factor removal and carries.
+
+Normalized coefficient drafts retain their buffer lease through full result admission;
+withExtendedLifetime prevents an optimized-away lease from refunding a still-live
+number alias. Working storage has invocation leases and a checked 2*numberDigits+2 scratch
+bound; that is a derived storage bound, not an iteration guard. Result digits,
+exponent and normalized token bytes retain independent native limits. Host-index
+narrowing is checked before allocation. A 1e1000000+1 probe fails before dense
+storage; multiplication by zero uses exact sparse computation. Numeric work and
+retention cap/cap-minus-one checks exercise actual operations. A 300-digit product
+is cancelled after 5,000 charged units inside its nested multiply loop and reclaims
+all scratch while retaining terminal health. wasm32 execution is still a gate.
+
+`--division-scale N --rounding half-even` is an explicit pair. It quantizes every
+numeric division, including finite values; reports count nonzero discarded
+remainders. Builtin round instead uses ties away from zero. The cumulative report
+uses totalInputBytes/totalOutputBytes/totalWorkUnits and preserves completed versus
+terminal failure. Diagnostics carry metric/limit/attemptedUsage/overflow and source
+byte offsets when known. Version 1 limits files may omit the version field.
+
+String/array/object operator overloads preserve exact scalar/key identity, bounded
+collection ownership and insertion order. Recursive object merge uses an explicit
+stack. Range yields one exact step at a time with end-exclusive comparison and a
+nonzero step; it does not allocate a complete output array or impose a hidden
+10,000-step cap. All arguments/replays and resulting collectors remain finite.
+
+Independent fixture generator: Python integers/fractions.Fraction, seed 0x140C3,
+738 cases, SHA-256 57b2affc52c872fdbc9e6cb25168bdd8b5999db6d8e5d8a988ff99cbf2c7accb.
+Ten arithmetic tests and 17 authored C3 subprocess vectors pass. Full native,
+safety and DocC refresh passed on the corrected handoff source; see Qualification.md.
+The authored fixture bytes remain unchanged. Vector invocation adds the documented
+`--` terminator so negative-leading filters are operands, keeping unknown flags
+strict. The initial two argv failures are retained, not counted as successes.
+
+Review corrected a prototype probe expecting 2*D+2 overflow for D<Int.max:
+on 64-bit that expression still fits UInt64. The final test instead proves a small
+allocation under a large finite D works, then rejects Int.max at the actual host
+allocation boundary; no configuration or test was weakened to hide a real overflow.
+
+Release-mode integration caught an actual domain-handoff issue after coefficient
+leases were extended: output's scratch baseline included queued refunds, then an
+inner checkpoint drained them. The job domain handoff now drains refunds before
+new-stage baselines. A regression verifies the live result remains charged while
+dead drafts disappear and work never refunds. The failed native receipt/vectors
+remain retained; refreshed lanes are required after this correction.

Documentation/Architecture/Release1.4/Progress.json

@@ -3,13 +3,13 @@
   "target_release": "1.4.0",
   "renderer_base": "3c1e8a1a1bc8d03699665b8ab98f5ece7962aff7",
   "main_at_orientation": "25fb04f747e583209b4c4511abf39e11ef5b4f80",
-  "branch": "codex/1.4-json-cli-query-core",
-  "status": "Native pull query-core milestone qualified; complete C0-C5 integration remains open",
+  "branch": "codex/1.4-json-cli-exact-arithmetic",
+  "status": "Native exact-arithmetic milestone qualified; wasm32 arithmetic and complete C4/C5 remain pending",
   "gates": {
     "C0": "partial",
     "C1": "partial",
     "C2": "partial",
-    "C3": "not_run",
+    "C3": "partial",
     "C4": "not_run",
     "C5": "not_run"
   },
@@ -21,9 +21,9 @@
   "core_metrics": 49,
   "cli_metrics": 16,
   "publication_performed": false,
-  "root_test_functions": 256,
+  "root_test_functions": 266,
   "root_parameter_cases": 199,
-  "native_source_manifest_sha256": "c8f09d2eaa6cf14f3efb11e8a2645796075c54274fa6b8af9db464fe27b173aa",
+  "native_source_manifest_sha256": "33439f5716ac7e33e01e477db4cb018547618fa7b74885867bb2b290ba43d7e0",
   "qualified_lanes": [
     "native",
     "safety",
@@ -53,10 +53,32 @@
       "root_test_functions": 232,
       "root_parameter_cases": 177,
       "native_source_manifest_sha256": "864d9b3dd8e1d79a0a6cbec862476843ddca2ff8a1582471b80fba54b863459e"
+    },
+    {
+      "branch": "codex/1.4-json-cli-query-core",
+      "status": "Native pull query-core milestone qualified; complete C0-C5 integration remains open",
+      "gates": {
+        "C0": "partial",
+        "C1": "partial",
+        "C2": "partial",
+        "C3": "partial",
+        "C4": "not_run",
+        "C5": "not_run"
+      },
+      "root_test_functions": 256,
+      "root_parameter_cases": 199,
+      "native_source_manifest_sha256": "c8f09d2eaa6cf14f3efb11e8a2645796075c54274fa6b8af9db464fe27b173aa"
     }
   ],
   "query_functions": 24,
   "query_parameter_cases": 22,
   "query_vectors": 38,
-  "query_vectors_passed": 38
+  "query_vectors_passed": 38,
+  "arithmetic_functions": 10,
+  "arithmetic_oracle_cases": 738,
+  "arithmetic_oracle_sha256": "57b2affc52c872fdbc9e6cb25168bdd8b5999db6d8e5d8a988ff99cbf2c7accb",
+  "arithmetic_vectors": 17,
+  "arithmetic_vectors_passed": 17,
+  "cli_site_checks": 18,
+  "cli_site_metrics": 16
 }

Documentation/Architecture/Release1.4/Qualification.md

@@ -89,3 +89,35 @@ FileHandle.standardError. No unsafe annotation/flag or library behavior changed.
 Failed run 38593758299 and its actual compiler log are retained; a fresh hosted
 run is required before Linux closure. Local comparator rebuild and all 38 C2
 vectors verify the diagnostic-only fix on the supported Mac.
+
+
+## Exact arithmetic milestone
+
+Branch `codex/1.4-json-cli-exact-arithmetic` starts at query core 6e8f145
+(draft PR #24). Native/safety/docs passed on the same unchanged source manifest
+`33439f5716ac7e33e01e477db4cb018547618fa7b74885867bb2b290ba43d7e0`.
+Native: 22 actual commands, exits 0; debug/release 266 root functions and 199
+parameter cases. Safety: ASan same counts, eight TSan shared functions and clean
+strict memory safety/warnings-as-errors build. DocC: five catalogs. Receipts are
+`.build/ci/cli-c3-handoff-{native,safety,docs}`; the CLI lane additionally passed
+46 functions, 53 historical foundation subprocesses, 38 C2 vectors, 17 C3 vectors,
+and 18 operation-site/report checks covering all sixteen CLI metrics.
+The ten arithmetic functions evaluate the 738 independent integer/Fraction cases,
+actual digit/exponent/token/work/retention boundaries, host narrowing and inner-loop
+cancellation. Original suite/cap/exclusion/downstream counts are preserved.
+
+Failed predecessor receipts are retained: negative-leading vector argv lacked `--`;
+a release integration exposed queued coefficient refunds crossing output's scratch
+baseline. The corrected domain handoff drains refunds before a new stage. Tests keep
+live result reservations, reclaim dead scratch and preserve cumulative work/health.
+No tests or accepted output expectations were lowered. The initial host-width probe
+was mathematically wrong about 2*D+2 overflow for D<Int.max and was corrected to
+exercise the actual Int.max allocation/narrowing boundary.
+
+The pinned Swift 6.4 WASI SDK is installed (swift sdk list exits 0), but this milestone
+has not executed its arithmetic kernel on wasm32. Native macOS evidence does not
+close that row. The final C5 candidate still requires precise matching compiler/host,
+selected mobile library consumers, CLI installation/reproduction/performance and
+all inherited corpus dispositions. Provider helpers are not advertised or inferred.
+These receipts precede only this milestone ledger/prose update; runtime, tests and
+harness are unchanged. Final integration must refresh the affected final-source checks.

README.md

@@ -516,8 +516,11 @@ This feature train adds `swift-json` beside the six libraries. Its compiling
 foundation provides strict formatting, validation, Pointer selection, staged
 Patch and qualified HTML/text/Markdown rendering. See the [CLI plan](Documentation/Architecture/Release1.4/Plan.md)
 and [foundation contract](Documentation/Architecture/Release1.4/Foundation.md)
-for command semantics, cumulative budgets and qualification boundaries. Query and
-provider commands are advertised only after their separate gates pass.
+for command semantics, cumulative budgets and qualification boundaries. The pull
+query increment adds navigation, generators, control, bindings and exact decimal
+arithmetic; see the [query](Documentation/Architecture/Release1.4/QueryCore.md) and
+[arithmetic](Documentation/Architecture/Release1.4/Arithmetic.md) contracts. Complete
+advanced-filter/platform/provider qualification remains open before a 1.4 release.
 
 ```sh
 swift build -c release --product swift-json