# RST-03 — Determinism, deltas and replay

Status: IMPLEMENTED — library only; no network, no database, no CLI.
Date: 2026-10-09. Scope: `RUST_STATION_INGESTION_PLAN.md` RST-03 on top
of the RST-02 parser. Language: English document; user communication in
Portuguese.

## 1. What was added (`tools/station-prep 0.2.0`)

- `src/output.rs` — deterministic emission: sorted JSONL streams
  (`assertions.jsonl`, `candidates.jsonl`, `quarantine.jsonl`) plus a
  hashed `station-batch-v1` manifest (inputs with SHA256/bytes/rows,
  parser/policy versions, alias-reference digest, per-input counts,
  completeness, per-output hashes). `write_outputs` publishes through
  temp-file + rename, so a failure leaves no partial final file.
- Spill sort: past `spill_rows` pairs per stream, length-prefixed runs
  spill to caller-provided scratch space and k-way merge back in key
  order; run files are removed on success. `usize::MAX` keeps the pure
  in-memory path. Parse batches stay bounded by `Limits::max_rows` by
  contract; the spill seam is exercised, not speculative, and RST-07
  measures when lowering the cap pays.
- `src/replay.rs` — `replay_decision` over manifests: identical bytes
  under identical parser/policy/alias versions are `Noop`; changed
  bytes at a current edition are `Publish`; changed bytes at a
  regressed `edition_seq` are `Stale`. Same bytes relabeled at another
  edition re-evaluate idempotently.
- Shared `sha256_hex` helper; alias tables carry their reference
  digest; crate version 0.2.0 with `PARSER_VERSION
  station-prep-v0.2.0`. No new dependency (lockfile unchanged apart
  from the crate bump).

## 2. Determinism contract (precise)

- Accepted/candidate streams are byte-identical across input reorder
  and across spill/no-spill paths; manifest output hashes match with
  them. The manifest binds exact input bytes, so reordered sources keep
  distinguishable input fingerprints with identical counts.
- Quarantine locators are positional by design (`file:logical-row`);
  reordered inputs therefore compare by quarantined content
  `(reason, detail, source_key)`, which is identical.
- A golden test pins one production-shaped row checksum
  (`6f15da0b…4e75fe23`): changing the canonical form changes every
  checksum and breaks the build on purpose.

## 3. Evidence (revision `e8d6905` + working tree)

- RED → GREEN: new `tests/deltas.rs` (9 cases) failed first on missing
  `output`/`replay` modules, then caught two real defects: sort keys
  containing `\x1f` colliding with the run-file separator (fixed with
  length-prefixed framing) and the positional-locator overclaim above
  (fixed by testing content equivalence). Final: `cargo test --locked`
  — 4 unit + 9 parser + 9 deltas passed.
- Cases: golden checksum, reorder equivalence, corrected bytes (same
  CNPJ, new checksum, `Publish`), unchanged replay (`Noop`), older
  edition (`Stale`), spill byte-equivalence with run cleanup,
  interrupted publish with no partial files, manifest roundtrip with
  counts matching written files, stable alias digest.
- `cargo fmt --check` clean; `cargo clippy --all-targets -- -D
  warnings` clean; `cargo audit` (1296 advisories, 25 crates): no
  findings. No network/process/`unsafe` in `src/`.

## 4. Limits and next task

- Cross-batch supersession merge stays the Go loader's job (RST-05);
  here corrections surface as new checksums plus `Publish`.
- Boundary-exact truncation remains the loader's manifest-count check.
- Next (smallest): RST-04 coordinate candidates — PMQC join/dedup
  hardening, CRS provenance and stale/conflicting/centroid cases with
  shared Go/Rust fixtures; still no automatic `reviewed` flag.