Define streaming ownership

Freeze configuration before byte zero

A caller constructs each Parser_Profile field explicitly. The API supplies no default profile, depth, name storage, or duplicate policy.

The parser validates and freezes the profile during initialization. An unsupported or incompatible profile fails before input consumption. The writer applies the same rule before it begins a destination transaction.

The implemented strict profile combination accepts any JSON value at the top level. It rejects a BOM, malformed UTF-8, unpaired surrogates, comments, trailing commas, nonstandard numbers, nonfinite values, and raw control characters. A caller can instead require an object root.

Parse one chunk without retaining it

The Flyology_JSON.Parsing generic receives its duplicate policy as a static generic argument. Each parser instance has caller-selected depth and name capacities.

Step consumes a count from an arbitrary-bound Stream_Element_Array. It returns one event, a need-input result, complete-document acceptance, or a failure. Drain runs the same semantic engine and fills a caller-owned event array.

Chunks can end inside UTF-8 sequences, escapes, surrogate pairs, numbers, literals, and structural input. Parser state carries only the bounded information needed to resume. It never retains the input array.

Keep lexical and decoded data distinct

An Event value has a private representation and carries absolute source coordinates. Number fragments expose the exact input octets. The parser does not normalize or convert a number lexeme.

A raw range borrows from the exact unchanged input of the producing call. The range stores counts, not an access value. Resolve_Raw_Range checks coordinate containment in a caller-described window. It cannot authenticate the identity or contents of an Ada array.

Name and string fragments also provide decoded UTF-8. An unescaped run can refer to the producing input. An escape or surrogate pair can produce one complete inline Unicode scalar. The caller must copy any raw range that must outlive the producing call. An event copy retains its inline scalar.

Select duplicate handling statically

Reject_Duplicates compares decoded member names as exact Unicode scalar sequences without normalization. A bounded crit-bit index avoids a scan over all prior names and has no collision-only fallback.

Preserve_Unchecked emits provisional events for every member in source order. It performs no duplicate storage, comparison, or selection. It does not mean first wins or last wins.

Strict duplicate storage is caller-selected through parser discriminants. Name_Octet_Capacity bounds retained decoded name octets. Name_Capacity bounds crit-bit leaves and internal nodes. The public contract defines exact-fit, release, denial, and diagnostic behavior.

Publish only a complete document

The Flyology_JSON.Writing generic binds one destination. The destination provides synchronous begin, write, commit, and abort operations for one whole-document transaction.

Begin_Document starts unpublished staging. Semantic calls then emit one balanced JSON value. Name, string, and number fragments can have arbitrary Ada bounds. A number retains the exact caller-supplied spelling after validation.

Finish_Document is the only commit request. Commit success is the only publication point. Destination exhaustion, validation failure, interruption, or commit failure does not publish a partial document.

The Ordinary_Compact output policy adds no whitespace or BOM. It preserves caller member order and exact validated number lexemes. It is deterministic for the same call sequence, but it is not canonical JSON.

Collect complete tokens in a separate layer

Flyology_JSON.Tokens copies selected decoded names, strings, or exact number lexemes into caller storage. Completion publishes the collected prefix atomically. Capacity denial publishes no token.

The generic Signed_Integers and Unsigned_Integers packages parse a complete strict integer lexeme with checked range results. They also render exact base-ten integers into caller storage. Parsing a JSON token and converting its value remain separate operations.

Keep integration policy outside the core

The current core performs no heap allocation. Caller storage, destination staging, and any consumer candidate remain outside that claim. The core has no dependency on a Flyology runtime, operating-system API, Type IR, or Wire.

The current public surface does not provide a DOM, an allocating convenience layer, or an accounting API. Binary64 and decimal conversion, canonical output, and consumer adapters are also future work. These features require separate design, evidence, and review.