Module split 

Typestate split roles: Split<Train>, Split<Validation>, Split<Test>, Split<CompatibilityTest>.

Implemented by plan 02-03. Typestate split roles: Split<Train>, Split<Validation>, Split<Test>, Split<CompatibilityTest>.

The role is a zero-sized type parameter and the only constructor is the bytes -> typed boundary, which validates the embedded source_split before it will hand back a typed value (D-16). A library caller therefore cannot express leakage, and honest- looking bytes with a mislabeled role are a typed error rather than a compiler-accepted Split<Train>.

There is no way to build a Split<R> from outside this crate

Both constructors are pub(crate). The only PUBLIC path to a typed split is a PreparedDataset constructor, and that is deliberate: a split validated in isolation carries no evidence about its siblings, so a train split obtained on its own could be paired with a validation split from an entirely different dataset. Binding them inside one PreparedDataset value makes that combination unrepresentable rather than merely discouraged.

The declaration carries no dataset-profile field

Profile identity is a TYPE PARAMETER of PreparedDataset, never a runtime field here. A runtime field would make the interesting mistake compile and fail at run time, and a compile-fail proof of “cannot be constructed” is unobtainable against an expression that compiles.

Structs

CompatibilityTest

The merged compatibility test split (D-19) — a role DISTINCT from Test, so a compatibility corpus can never be mistaken for a canonical one by name alone.

Split

A validated split of one role.

SplitDeclaration

What the caller asserts about a split before its bytes are trusted.

Test

The held-out test split.

Train

The training split — the only split a selection pool may draw from.

Validation

The validation split. Its existence is what a canonical dataset proves.

Traits

SplitRole

A split role. Implemented only by the four zero-sized marker types below.