Finally land the `before`-hardening campaign by plaidfinch · Pull Request #10 · oxidecomputer/rumors

plaidfinch · 2026-08-08T00:00:44Z

This is an almost entirely ground-up rewrite of before, replacing its internal representation with the "skyline": an interleaved tree topology with leaves encoded as Elias-gamma encodings of differences from the previous leaf. This, along with a lot of algorithmic improvements, hardens before against adversarial (and accidental) memory amplification on all inputs, and significantly accelerates its performance on even ordinary inputs, to roughly meet or exceed the speed of the pointer-based reference implementation, while using 100x less space.

There is still a lot to do to improve the internal legibility of the crate, as well as improve its documentation, but it's time to land this and make further improvements in later branches.

Constructed mutant (applied and reverted in-audit): Bits::ptr_eq with the pointer comparison dropped, leaving lengths only — clone identity forged by any equal-length pair. Seven suites caught it within a second (causally strict-span endpoints, codec injectivity/freeze parity, the ptr_eq clone-source pin, party pair laws, clock solo laws, organic populations). These are the shrunk inputs proptest deposited under the mutant; committed so the wrong-rung shape fails deterministically.

Shrunk by the OwnVersion matrix proptest while it caught a constructed mutation-adequacy mutant (masked walk's b-owned-alone interval folded without sign reversal). The seed rides along so that catch replays deterministically; the suite is green on the clean tree.

…annot supply itself The exhaustive small-scope suite is universally quantified over its enumerated corpus, so a silent enumeration shrink leaves every check green on a smaller universe; the module's own non-triviality floor (len > 20) admits shrinks past half the corpus, and the only committed red anywhere in the tree was grow's EXHAUSTIVE_GROW_PAIRS coverage pin (114621 -> 58037 under a constructed diagonal-drop mutant), whose failure message instructs re-derivation from the enumerated scope -- the circular re-pin. corpus_counts_are_exact pins the id corpus to the in-test-derived closed form 2^(2^d) (the region-subset bijection) and the event corpus to its committed size plus denotation distinctness by an independent path-sum evaluation. Demonstrated red under the mutant, green on the clean tree.

… pin The two grow-branch coverage pins' failure messages instructed re-deriving the constant from the enumerated scope / deterministic pools -- the corpus's own output. With corpus_counts_are_exact holding the enumeration total by counts the enumerator cannot supply itself, the messages now require that pin green before any re-derivation, so a corpus shrink can no longer be blessed by re-pinning downstream.

…t corners Round #141 value-correctness audit (r141-suanpan track). Mutation-adequacy attack on the committed suite found exactly two surviving mutants, both in the sign fold's decision rule; each gets a constructed witness through the public API: - SIGN_DECIDED 3 -> 2 passed suanpan's whole suite (41/41) including the 1.9M-state exhaustive ledger sweep; before's laws/codec proptests caught it only by random search. sign_threshold_survives_extreme_cancellation pins the corner deterministically: digits [-(2^33-1), -(2^33-1), 2] denote -(2^32-1), and a threshold of 2 reads them positive. - floor.saturating_add(2) -> saturating_add(1) in sign_dominates_at passed the ENTIRE committed workspace suite (suanpan 41/41, before 604/604). domination_decision_index_is_tight_at_floor_plus_two pins it: digits [-(2^33-1), -(2^33-1), 3] hold 2^64 - 2^32 + 1, which u64::MAX (covered by floor = 1) overturns, so a decision at index floor + 1 is unsound. - decided_domination_covers_extreme_accumulator_operands witnesses the contract clause before's query sweeps lean on (sign_dominates_at over another accumulator's digit_count - 1 before sub_accum): the operand spelled at the lazy-zone edge exceeds any magnitude the differential proptests can draw by ~2x, and the certificate still holds at its tightest decided value (partial exactly 3 at index floor + 2). - flush_right_carry_tie_converts_exactly pins the recenter tie whose remainder is exactly zero and whose read-out complement carry crosses a zero low digit. The before proptest seeds are the shrunk catchers minted while the SIGN_DECIDED mutant was under test; the real code passes them, and they make the laws/codec catch of that genre deterministic instead of sampling-dependent. Every mutation was applied and restored as a reversible string swap; git diff verified empty against 2a701f8 before this commit. Adequacy re-demonstrated on this branch (base 2e0cf5a, which adds only bench instruments), each mutant a reversible string swap restored to an empty git diff, suite 45/45 green after every restore: - floor+2 -> floor+1: exactly domination_decision_index_is_tight_at_floor_plus_two fails (44/45 pass; the rest of the suite is still blind to it). - SIGN_DECIDED 3 -> 2: exactly sign_threshold_survives_extreme_cancellation fails (44/45 pass). - floor+2 -> floor+3 (the conservative drift): decided_domination_covers_extreme_accumulator_operands fails at its decision-edge assert, alongside domination_floor_near_usize_max_never_decides. - complement_carry -> 0 in the read-out's ripple loop: flush_right_carry_tie_converts_exactly fails.

…nsumer suites Round #141, suanpan-2-SP-2 remediation, second leg. The independent verification leg ran before's suite under the SIGN_DECIDED 3 -> 2 mutant and shrank every failure it drew; these are those seeds, spread across nine consumer suites (causally, codec, meter/tier2, serde_impls, algebraic laws, skyline emit/query/sweep, version). All pass on the shipped code (732/732 with them committed); under the mutant they turn the consumer-side catch deterministic (seed replay, not sampling) - re-demonstrated here: with the mutant applied, the codec bit-flip suite fails in 0.07s at PROPTEST_CASES=1, where pre-seed the same setting produced zero catches. The primary instrument for this corner remains suanpan's own sign_threshold_survives_extreme_cancellation; these seeds are the consumer-level backstop, committed per the always-commit-seeds rule.

The identity ladder's empty rungs (v OR 0, 0 OR v adopt-wholesale, 0 AND v, v AND 0, and the span forms, refs and view doors both) were deletable with the entire 732-test suite green: the general emission walk produces byte-identical values, so every value law stays green, and the identity_fast_paths pins drove only the clone-identity and byte-equal rungs. Measured under the deletion mutant: the adopt rung's join reads 120 scanned bits (the full operand walk) where the rung reads 0. This pin makes the whole empty-rung genre red under deletion, with a concurrent-pair walking control proving meter liveness.

…es included The operator matrix routes exclusively through the in-place cores, so the borrowed-pair cores' empty rungs (join_refs/meet_refs) are reachable only through two-element folds; four fold-door cells join the matrix, plus the two in-place arms (v |= 0, 0 &= v) the original cells missed. Demonstrated: killing only the refs rungs reads red at join_fold_noop; killing all ten rungs reads red at the first cell; restored tree green.

…tial for the over-full-slot hand-back arm The 6-input family [a, b, alias(a), c, d, e] retains alias-c on the stack at weight 1 and coalesces d-e into it; misrouting the retained group to the rejection channel diverges on hand-back contents and the final accumulator. The 4-input family the finding proposed is mutant-equivalent: the closing drain rejects the retained group anyway. Mutation-verified two ways (fails under the misroute, passes shipped).

… its arm The party-side deterministic witness for the over-full-slot hand-back arm gains its clock twin (per-caller differential discipline: the clock fold carries versions through the same retention decision). Both read red under the misrouted hand-back (rejected.push in place of the weight-retaining stack.push) and green restored; the party witness's doc now states why the narrower arity-4 shape cannot witness the arm.

…place/dominance_of clone rungs live Constructed in round #141 (mutfast track): Bits::ptr_eq -> always false passes the ENTIRE meter binary (157 tests incl. identity_fast_paths) — the canonical_eq ptr rung is shadowed by the unmetered memcmp rung, the comparison sweep dispatches on slice_ptr_eq, and the two causally.rs coincident rungs had no pin at all. These two tests pin the coincident rungs by scan parity with their collapsed forms (equality, since the fused walk's dominance early-exit can legitimately read fewer bits), beside distinct-buffer walking legs; both read red under the mutant (place 61-bit walk vs 66-bit collapse; dominance 61 vs 66).

…ard is test-surface only Every compiled stacker call site is cfg(test) (recurse::grow behind the test-only descend!), so the production dependency bought nothing for downstream graphs: rumors consumers, the fuzz workspace, and the wasm32 guest all built stacker+psm for code that never compiles for them. The depth-100k deep_tree_stack_safety proof passes with the dev-dep placement (the self-dev-dependency idiom supplies it to the cfg(test) lib build). recurse.rs's exception inventory now names all three test-surface descend! users (oracle bridge, grow reference probe, segment-liveness dive) and carries the dated keep decision; the crate AGENTS.md hard rule and no-unsafe clause are re-derived to match.

…sm the code lost deep_tree_stack_safety's comments named a deleted equality shortcut and a recursive combine walk; they now narrate what runs — canonical_eq's byte compare at the top of join/meet, distinct non-empty operands reaching the skyline sweep at full length. fuzzfit's MAX_WASM_STACK derivation claimed guest traversals recurse on tree depth; the constant is slack over an input-independent stack, and its comment now says so. byte_view's doc drops the call-site tally (its callers, not 'the two'). error::Overlap's rustdoc attributes it to its sole producer, Clock::sync — Party::join and Clock::join hand back the operand and cannot return it.

… toolchain floor re-measured The 2026-07-31 amendment records the landings (Span wire review merged, the causally-kernel round's span half, the step! retirement with the stacker remainder resolved this round, the variadic law suites, the Bytes round with its review closed); §14/§17.2 re-derive to the survivors and every item cross-reference follows the renumbering. The root AGENTS.md toolchain floor moves from the rotted 1.85 claim to the measured 1.92 (workspace source floor; locked dependencies move the working floor with Cargo.lock).

benchjudge validates denominator growth before the judgment floor (a shrinking sidecar pair on a sub-floor cell was a silent SKIP where the same pair on a judged cell was exit 2), and the SKIP row renders raw nanoseconds so a just-sub-floor median can no longer print as equal to the floor it is below; both pinned in --self-test, each pin verified to convict its mutant. doclint and testdoc hard-error (exit 2) on a nonexistent root: a renamed directory must fail the gate, never silently vacate its coverage.

…rror drives the op it names surfacecheck's exception-date check reads YYYY-MM-DD positions and ranges instead of counting dashes (the '20-26-07xx' witness now reads red, pinned in tests), and walk_use asserts a use target absent from the index appears in the paths table — malformed rustdoc JSON must never read as a smaller surface. fuzzfit's fit() doc states the actual floor guard (two above-floor samples, else the full set), and the VersionTick mirror arm calls Version::tick directly instead of the delegating Party::tick twin.

…ndent backend errors, and the queued-SupplyClosed recovery arm Two committed witnesses for the unified supply-failure terminal (proxy/work.rs execute + streams.rs): - deposited_supply_failure_masks_an_independent_backend_error: pins the DEFECT mechanism — a typed backend failure racing a dead stream supply is replaced by direction-granularity SupplyClosed, falsifying proxy/error.rs's claim that errors the supply did not cause surface from the failing operation itself. Owner picks: exempt backend-typed errors at the terminal match, or weaken the Error rustdoc. - queued_supply_closed_outranks_a_selected_consequence_at_stream_granularity: deterministic reach for the terminal's queued-report drain arm (previously unwitnessed): stream-granularity origin wins over the deposit's direction granularity, deposit attached as cause.

… framing, boundary-arity fan folds Adopted from the round-141 interaction audit (r141-interact 98d724b9 + 4bd559e2), relocated into the suites that own each seam: - codec::tests::version_and_clock_doors_reject_intra_byte_padding_functionally: the Version/Clock byte doors reject a set bit inside the final byte's padding as a functional Err (the only release-profile witness at the Clock door, where the party leg's length arm is vacuous). Red under a length-only require_zero_padding substitution at clock.rs. - borsh_impls::tests::coincident_span_keeps_borsh_container_framing: the Equal admission arm holds container framing exactly; red under an EOF-tolerant one-byte over-read in the arm (which every lone-value test survives). Plus the padding-genre sibling coincident_span_borsh_rejects_tampered_join_padding. - version::tests::boundary_arity_fan_folds_match_the_sequential_fold: counter-boundary arities (k=4 level fill, k=6 straddle) over fan-shaped concurrent operands salted with an adjacent clone run and an empty version equal the sequential fold on all three fold doors; red under a collapse-everything dedup mutant. - two committed fill-walk flag-site seeds (5bf15dbe from the audit track, 7ef9d658 its verifier mirror): the changed-flag differentials catch both flag polarities on seed replay alone (verified at PROPTEST_CASES=1 under the under-eager mutant). The audit's degenerate-span rung-vs-walk unit test was deliberately not adopted: the committed coincident_span_rungs_agree_across_buffer_identity proptest already samples that space (the finding was refuted).

…s the Error contract A typed backend error (Encode/Decode Backend) is the local store's own failure — the dead supply cannot have caused it — yet the terminal's outranking replaced it with a direction-granularity SupplyClosed, falsifying proxy::Error's promise that errors the supply did not cause surface from the failing operation itself. The terminal now matches backend-typed errors ahead of the supply-outranking arms; the adopted masking witness flips into the attribution pin (verified red with the exemption removed), and take_supply_failure's symptom inference is true as stated.

…nterval walks deep_tree_stack_safety drives the clock ops at 100k; nothing drove rank/distance/lag/Ranked, the Rank wire round-trip, span hulls, Span decode/place/dominance, Range bounded classification, or projection at any depth past 300. All are iterative walks; this pins that fact against regression the way the clock-op proof does.

…n is the load-immune one The catch-up leg carried the suite's only absolute wall-time ceiling (5s over a quantity that is almost entirely serialized dev-profile compute), so any loaded gate run could flake it — a threshold over a noisy quantity relocates the flakiness to the threshold. Promptness is a property of the session shape, already pinned load-immune as exact virtual hops by the ladder-bound siblings; the real-clock test now asserts only floors (the catch-up's irreducible round trip, the serialized session's wave time), which machine load can inflate but never falsify.

…d dependency's name goes The invariants were already stated positively; the discovering-incident sentences cited a dependency absent from the entire graph. Provenance lives in git history; the prose keeps what is load-bearing (the symptom genre the total sweep catches, its 2-of-25 sweep positions).

…e shared-buffer form r141 findings mutmeter-1-MM-1 and mutmeter-4-MM-4: no gate leg consumed the board's live verdicts (a 172-red board exited 0 under the audit's MUTANT-OC16), and a board built without the counter features silently rendered limb/scan/touch unjudged while still printing verdict colors. - examples/amp_board.rs: at the scales of record (default and acceptance), a red count disagreeing with BOARD_EXPECTED_REDS exits nonzero, so the amp-board-shard-pin gate leg (which runs both record scales) now consumes verdicts with zero added gate time. Demonstrated: under MUTANT-OC16 (cursor.rs read_bit tap 1->16) the scale-1 run reads 61 red and exits 1; restored, honest run reads 0 red and exits 0. - Cargo.toml: amp_board gains required-features = [limb-meter, scan-meter]; the unfeatured invocation (which hid 89 of 111 red verdicts in the audit's measurement) is now cargo's own loud error. Landing the verdict consumption surfaced 42 untriaged reds the verdict-blind gate had blessed since the 2026-07-30 Bytes-backed at-rest form (92ed220) and its Phase B adoptions (20bd3c1) — floor premises those commits obsoleted, readings honest: - clock_fork x 25 families: the heap floor still priced the forked child's version hand-over as a byte copy; it is a refcount bump on the shared stored buffer. Floor trued to NA with the dated declaration (floors.rs NA_HEAP_FORK_SHARES); heap_fork_child dissolves. - clock_own_version_to_version x 17 families: the scan floor demanded a stream walk the seed fast path (to_version's whole-interval arm, an O(1) buffer-sharing clone) legitimately never performs. Scan floor trued to NA for seed clocks (NA_SCAN_SEED_PROJECTION); any other party still carries the full-examination floor. - version_span_all x benign (acceptance scale): heap exponent 1.28 read from a probe pair straddling the flat allowance — the flat term the constant leg forgives deflates the sub-allowance base and manufactures the exponent (every non-straddling span_all family reads <= 1.0 at up to 4x the arity). The judge now fits the heap exponent only where both probes clear the allowance; the straddling pin in board/tests.rs reads red under the old max rule (mutation-verified, restored, diff clean). Board movement, parent-measured: my diff cannot move a reading (the render pipeline is untouched; exit-code consumption and floor/judge declarations only). Scale-1: 1804/42 -> 1846/0; acceptance: 1845/1 -> 1846/0; the only verdict flips are the 43 cures above, every other render diff is an exponent leg honestly unjudged (-.--) with its reading byte-identical, a floor column rendering '-', or legend text. amp-board-determinism, amp-board-shard-pin, worst-cases-pin all green.

… a different peer decode(&encode(a)) zeroed scope_id, so a link-local advertised name passed Endpoint::new's length-only validation and lost its scope in the LINK header — the peer's reverse dial then targeted an undialable unscoped address with nothing pointing at the cause. encode now panics on a nonzero scope_id (a configuration bug caught at endpoint construction, the router's one encode site); flowinfo labels a flow, not a peer, so it stays uncarried and documented. The Addr contract states the general rule: refuse a name the encoding cannot carry faithfully, never alter the dialed peer. Both behaviors pinned.

… bump r141 finding totality-2-TOT-2: the Bytes-backed at-rest form made every version/party clone a refcount bump, and complexity_claims.rs, worst.rs recorded the new truth (dated 2026-07-30) — but the two reviewed exemption tables kept the byte-copy mechanism story at 13 sites, every one contradicting the dated comments on the corresponding claims: - crates/before/src/meter/board/coverage.rs: Party::dangerously_alias (:75, the site the audit's roster missed), Clock::forks (:105), Clock::dangerously_alias (:132), Ranked::into_owned (:143), Span::into_parts/into_owned (:220/:229), From<Clock> (:244). - crates/before-fuelscape/src/ops.rs: Ranked::into_owned (:923), Clock::forks (:944), From<Clock> (:981), Party/Clock:: dangerously_alias (:1059/:1063), Span::into_parts/into_owned (:1162/:1172). Per-site re-denomination toward the code, not a blanket substitution: Ranked::encode's 'one version byte copy' (ops.rs:1001) stays — encode genuinely copies the bytes into its output.

…ow the root fan arb_divergent_pair's keys are content-addressed, so its universe is a fixed set of blake3 outputs that scatter at the root: the join walk's divergent (Some,Some) arm below the root was deterministically unreachable for the biconditional pins (measured zero entries at depth >= 1 over 10,240 samples). Wider random budgets cannot cure that — only chosen paths can share a prefix — so the new arb_deep_divergent_pair draws the divergence depth and both novelty widths (zero included, so subset, identical, and ceiling-only merges sample the false arm at depth), and a deterministic companion pins the three deciding shapes on the 31-byte-prefix fixtures: gain both directions, deletion honoring at depth, and the full-depth subset merge that must read unchanged.

…le varint)

deep_tree_query_and_causal_stack_safety covers the query folds; the event tree's text render/parse walk and min_ticks had nothing driving them past proptest depths. Re-derived from the predecessor track's interrupted draft against today's tree.

…e, range_bounded The arity-3 fused placement walk (one probe against the pair hull's two bounds) had no committed pass/fail resource instrument: the board's span rows price the wire form and causally_contains only the single-bound degenerate path, and the meter suite's placement pins run on one organic fixture. Three rows now drive the walk through every version-pair-bearing family at both scales, probed by a buffer-distinct re-decode so the coincidence rung cannot collapse the walk; the range_bounded row prices the composite a consumer reaches from owned endpoints (known_at's validating comparison rides along, stated at the row). Every new cell judges GREEN at both scales (no amplification finding: per-byte flat on every family, matching the audit's constructed- adversary readings). Rankings pinned from the live release fold at both scales with a movement annotation; every pre-existing entry verified unmoved (worst-cases-check clean, 166 rows x 2 scales). The registry's declared bundle reach moves +3 on every version-pair family (the board smoke pin re-stated); the placement claims now cite their own rows instead of the degenerate-path row.

…lip amortization Three adversarial-family witnesses adopted from the round-141 whitebox audit (r141-whitebox 3da8a989), each asserting a bound on a population no committed instrument drives: - tests/answer_embedded.rs: min_ticks/rank on wide-base tiny-tail (mixed second difference over a 2x2 (n,w) grid bounded at a tenth of the top cell: no n x w product; the wide answer is paid once, never per leaf) and on the wide ladder (per-packed-byte flat: near-equal wide minima discriminated within the bits that spelled them). - tests/fold_skeleton.rs: span_all per-byte flat when a shared deep skeleton doubles at fixed arity (the committed fold populations are all small-operand; this is the O(D log k) model's D leg). - suanpan/tests/amortized_sequences.rs: the sign fold's amortized O(1) under wide sign-flip oscillation (every committed band holds one polarity; the dual carry-boundary parking attack is already the accum_comb_touches_flat band, so only the sign-flip leg lands). Not adopted from the audit branch: the placement flatness sweeps (the board's placement rows now judge the same shapes with envelope discipline), and the print-only isolation probes (no asserts: their attribution findings are discharged in the audit record).

…weep Create version/skyline/overlay.rs and move into it, from sweep.rs, the walk machinery every multi-stream merge shares: PlateauCursor, Crossed, advance (the binary overlay-advance law, functionally identical and still infallible), LeafCursor, Step, Side, fold, advance_diff, and OpenedPair; and from query.rs, IdLeafCursor (cursor vocabulary consumed by masked.rs and query's project, not query logic). sweep.rs keeps the comparison layer: Directions, order_exit, eq_exit, the private sweep loop, and the entry points causal_cmp/eq/le/concurrent at their unchanged pub paths. Doc split, riding the move: the minted plateau/tiling vocabulary, the boundary-bookkeeping essay (the law's correctness argument, its three dyadic-interval facts intact, re-denominated for the generic home), and the cursor-cost argument move to overlay.rs's module doc; sweep.rs's module doc keeps the comparison semantics (elementary intervals, the one running difference, the Directions fold), Early exit, the comparison-specific Cost (skyline_cmp_* rows, flatness, zero grown segments) now citing overlay for the walk's argument, and Testing. The former opening client inventory is trimmed away: each client module names what it consumes. Every consumer re-points to the one new path (no re-exports): masked.rs, place.rs, place/filter.rs, admit.rs, emit.rs, query.rs, party/ops/diff.rs, emit/tests.rs, query/tests.rs; intra-doc links to the moved items re-aim at overlay across masked, place, filter, admit, emit, query, and diff. Renames in the two rewritten files only: advance's fa/fb -> flip_a/flip_b and ca/cb -> crossing_a/crossing_b; sweep.rs's dirs -> directions; LeafCursor::descend's k -> internal_nodes. Assertion pass: the tie-level debug_asserts, the canonical-input expects, and the final-leaf unreachables are contract and invariant checks and stay unchanged. Behavior is byte-identical: no meter constant moves, worst-cases-pin reads clean (168 pinned rows at 2 scales), and the full gate matches the known-red baseline exactly (docs/docs-internal/doctest/ fuelscape-test/surface-totality red for the pre-existing out-of-scope causes; test-all fails only the same 4 pre-existing rank-Display and surface-roster tests).

Wave 2 of the legibility restructure (plan D4), zero behavior change: every output is byte-identical (oracle differentials and the exhaustive small scope green), every committed meter constant reads identical (worst-cases-pin: clean, 168 pinned rows verified at 2 scales), and every fast path survives verbatim (the tiny-range first-leaf-depth < 2 gates, the block scans, the continue_verbatim splice and its held_at gate, the verbatim Out mode and matched-prefix skip, the memo's no-position-scanned-twice discipline). Moves: - fill/memo.rs (new): Memo + position_check, with the frame-ledger reference-discipline essay as its module doc (what a site is, what a link is relative to, write vs consumption order, the one-create/ one-consume lifetime). - fill/prescan.rs (new): PreScan + PreFrame + PreFrames, with the fill-equations-restricted-to-the-minimum table as its module doc. PreScan::new replaces fused_fill's 10-field struct literal. - fill.rs keeps tick/ticks, FillOutcome, fused_fill, FillWalk, Relation, Frame/Frames, scan_min_from, and gains DeltaReg — the named monotone-register/PopStack delta idiom, rebased at its four sites (Frames.keys, PreFrames.slots/.positions, expand_subtree's keys). - fill.rs module doc: the Limb cost paragraph recut as a charge inventory (every measured claim and meter-row name preserved); the memo material re-pointed at the new submodules. D7 (assertion minimization by construction): - Memo.queue: Vec<u32> 0-sentinel -> Vec<Option<NonZeroU32>>; set_link pushes first so the index is provably nonzero (the remaining expect is the u32 capacity contract); take_link becomes a typed Option read; a const assert pins the niche (one index-sized cell per site). - PreScan.first_slot: usize::MAX sentinel -> Option<usize>, and the suspend tuple (Accumulator, Accumulator, usize, u32) -> the named SuspendedLevel struct. D8 (naming, applied across fill.rs, memo.rs, prescan.rs, fuse.rs): ev -> event, h -> height, corr/Corr -> relation/Relation (H -> Height), d1 -> first_leaf_depth, d -> leaf_depth/arm_offset/out_delta/distance by role, neg/mag -> negative/magnitude, v -> absolute, x -> chain_span, rest -> remaining, vals -> values, l/r/m -> left_cost/right_cost/ cheaper (and left_distance/right_distance/nearer), el_start/l_end -> collapse_start/site_pos, pending_rel/seed_rel/install_rel -> *_relation, off -> offset.

Wave 3 of the skyline legibility restructure (plan D5), zero behavior change: all 776 before tests green, meter suite constants identical, worst-cases-pin clean (172 pinned rows at 2 scales), full gate clean. Moves: - query/integral.rs (new): FREEZE_ALLOWANCE_DIGITS, Integrator, Arming, WindowMass, Aggregate, charge_segment, charge_digits, clusters, u32_digits, int_digits, base_digits, meter_product, meter_window_digits. pub mod (overlay.rs precedent), items pub(super), no re-exports: query.rs, query/tests.rs, and query/web.rs re-point to integral's one path. - mul_into moves query.rs -> query/web.rs (its only non-test consumers: web's settle and EpochLedger::settle); tests reach it at query::web::mul_into. - query.rs keeps rank, distance, lag, rank_cmp, pair_integral, pair_fold, min_ticks, project, absolute_height, max_depth. Doc recut (D6): query.rs keeps the catalog, the sigma/orientation table with the valuation identities, a short height-split statement, the reader-routing Cost summary, and Testing; integral.rs receives the per-boundary algebra (the dh* derivation), the anchored-segment discipline (the h* = B + P + L split), and the funding material, recut into headed sections: the split -> the freeze trigger -> the promotion ledger -> the settle tree -> the charge inventory -> the settle bound and multiplication floor. Every meter row, band, committed-witness name, measured number, and epistemic marker preserved. Anchors re-aimed at integral: query.rs fn docs, web.rs's funding-arity note, tests.rs's kernel commentary, meter.rs's wide-arming and jump-pair prose. D7: Integrator::open now folds through signed::fold_signed_int (the match duplication was its body verbatim); settle_armings' leaf storage drops the Option-take dance for a draining into_iter cursor (verified: the left-first reduction reaches unit ranges in ascending order) plus a running-sum prefix, removing the 'each leaf reduces once' and 'seeded nonempty' expects; WindowMass::combine uses Peekable::next_if, removing both 'peeked' expects. The two committed adequacy settle kernels mirror the new spelling so their 'reduction verbatim' claims stay true. D8 renames: seg -> segment_mass, pos_local -> banked_window, Arming.neg -> negative, p_/w_/t_/seg_ readouts spelled out (parked_/window_/final_window_/segment_), ca/cb -> cursor_a/cursor_b, da/db -> step_a/step_b, orient -> current_orientation/new_orientation, sc/ic -> event_cursor/id_cursor, f -> flip, ev_bits -> event_bits, num -> numerator, l_sign/l_mag -> live_sign/live_magnitude, base -> floor_index (charge_digits' cluster floor), t -> digit_sum (mul_into), d/c/t -> digit/carry_out/sum (combine), i -> limb_index; 'one' kept with its doc. Adequacy kernels mirror the field renames so they read in lockstep with the shipped integrator.

…ty N The pick/tie/assert skeleton of the overlay-advance law previously lived four times: overlay's binary advance plus hand restatements in masked (arity 4), place (arity 3), and filter's admits and coverage (arity N). The three restatements now dissolve into one generic driver: - overlay.rs gains CursorSet (priority/depth/step over numbered slots) and advance_set, the law's arity-N, fold-internal face beside the binary advance (arity-2, crossing-explicit — unchanged, all callers untouched). One priority sequence serves both tie-breaks: the pick takes the first slot in priority order achieving the maximum depth, and tied slots step in priority order. The tie assert lives once, in advance_set. The driver allocates nothing per round; priority iterators are owned ('static) const-shaped arrays or index ranges — the one signature adjustment from the planned shape, needed so the driver can hold the sequence across the mutable steps. - masked.rs: Walk implements CursorSet directly, priority [B_MASK, B, A_MASK, A] (reproduces the last-max pick exactly; the tied-others order flips ascending→descending, the sanctioned wibble). block_skip keeps its structure and gating verbatim, with an others_deepest(slot) helper replacing the twice-repeated depth maxes. Renames: am/bm → a_mask/b_mask, ha/hb → height_a/height_b, dirs → directions; named slot constants replace magic 0..4. - place.rs: the walk's cursors bundle into Cursors (probe + two Option<BoundSide>), priority [PROBE, START, END]; the fold_probe/ step_bound closures become the step impl's arms, and the two "slot N is the present ..." pick-site expects collapse into one absence-invariant expect shared by both bound arms. - place/filter.rs: MemberCursors ([PROBE, bounds...]) and SpanCursors ([HI, LO, bounds...]) replace the two hand-rolled advances; the Deepest enum and the duplicated fold_lo/fold_hi/fold_probe/step_bound closures dissolve into the set impls. dirs → directions throughout. Byte-identity: outputs are byte-identical everywhere — the full suite (776 tests) is green untouched, including the differential proptests against the composed sweeps and the exhaustive small-scope suites. Meter movement: none. Every masked and placement MEASURED reading is byte-identical to the parent commit (masked triple: limb 47, touches 4_704, scan 16_390, heap 1_256; masked quad: limb 24_614, touches 68_181, scan 1_073_674, heap 1_952; all placement relational identities including the one-bound degenerate ≡ pair sweep, scan 714 = 714 and limb 20 = 20). No constants re-pinned. The sanctioned masked tied-order wibble does not materialize on the committed families: it requires a mask strictly deepest with both event cursors tied at the flip, and no committed scenario's a/b fold interleaving crosses that window with order-sensitive carry work. worst-cases-pin: clean, 172 pinned rows verified at 2 scales (unchanged).

…s as clients Wave 5 of the skyline legibility restructure: CONSTRUCT. The full generic unification landed; the fallback (shared kernels + one essay) was not needed — evidence below. Design - skyline/watermark.rs now holds the one anchored-minimum web: MinWeb<P> with the register named `gap` (one name for the two webs' registers), the latent boundary, Entry<P> { ZeroRun, Diff { boundary, payload } }, Boundary { Word, Wide }, the follower slots + anchor_relative tags (core-resident; only the fill walk installs followers), and the pool. The twin ~100-line propagate loops and the literally-duplicated decide_undercut_through_latent are one body each; the twin module essays are one canonical essay (representation, width-conservation move inventory, followers, the payload seam). - Hooks, not traits: boundary-killing paths take on_die: impl FnMut(P); the pushed-above arm mints its payload lazily (impl FnOnce() -> P); close returns Close<P> { Pending / Retired / ZeroRun / Parked(P) } for the client to dispatch. Two arm entries preserve each client's exact op sequence: arm_at_height (the v = h arm — the gap moves out whole, no fold) and arm_below (the funded-accumulator arm). - fill/watermark.rs is deleted; fill.rs and prescan.rs drive MinWeb<()> (the payload-free surface lives beside the core; the MinStack name is retired with no alias — the instantiation is visible at the type). query/web.rs is the thin min_ticks client: ReignWeb { web: MinWeb<Reign>, winner } with Reign, settle, EpochLedger, mul_into; its module doc states only the fold's deltas (reigns, the epoch ledger, the one-ledger funding arity) over a pointer to watermark. Constructed diff: 738 (fill/watermark.rs) + 754 (web.rs) twin lines become 1,021 (core + essay) + 389 (client); the instantiation glue (Close, the hook parameters, the wrapper) is far under the deleted twin bodies. - Word compaction is a per-instantiation constructor policy (MinWeb::compacting() — min_ticks; MinWeb::new() — fill), decided by measurement (below), stated undated at both constructors. Byte-identity and meters - Outputs: the full suite is green untouched (776 tests — the tick/fill and min_ticks differentials against the recursive oracle, the exhaustive small scope, every snapshot pin). - Meters: all 282 MEASURED readings of tests/meter.rs byte-identical to the parent; the amp board matrix (2,014 cells) byte-identical; the worst-case map byte-identical at both scales; ranking pin clean (172 pinned rows verified at 2 scales). Zero re-pins: min_ticks rows and fill rows identical everywhere. Construct-and-measure record (measured on the constructed diff, gated by the stop rule, kept out of the landed behavior): - Sharing web.rs's push-time Word compaction with fill read +1 touch per word-scale site on two committed families (memo_comb 36,519 -> 37,518 small / 73,019 -> 75,018 large; reveal_comb_hifloor 42,234 -> 43,234 / 42,834 -> 43,834) and moved peak heap on no committed row: the predicted transient win does not materialize on fill's committed shapes (its boundary buffers pool either way). Compaction is therefore elected per instantiation; the min_ticks instantiation keeps it with its pinned op sequence byte-for-byte, Word arm included. - Routing fill's emit_here arm through arm_at_height (dropping the no-op fold of the leased zero) read -1 touch per arm (ascend_cliff 8,432 -> 7,432 / 16,848 -> 14,848; pure_comb 3,122 -> 2,122; memo families -2,001..-7,999) but breaches four committed liveness floors from below (tick_run's one-per-byte on ascend_cliff_plateau: 1,438 < 1,651 B; pure_comb 2,234 < 2,425 and ascend_cliff 14,848 < 15,636, both measured-x0.75 floors). An honest improvement under a liveness floor is a floor-premise finding, left for an owner decision; fill's arm paths stay op-identical (arm_below with the leased zero). Move-discipline attestation (each claim checkable in the unified body): - a close parks its popped boundary by move, never a fold: close -> park (mint move / min-into-max merge; Word arms add one machine word). - an arm recycles the latent into the new boundary: push_boundary's merge_into_wider before the trichotomy. - a wide gap is never folded while it survives: emissions fold and restore only the priced offset (emit_offset's post-sign word-scale fast path intact); undercuts move gap out whole; the bridges fold gap into a dying, code-priced delta. - each propagate hop's dying side funds its fold, top-index domination deciding direction before any fold, only comparable scales folding undecided: propagate, one body. - a set follower tag never outlives its latent: park tags, resolve_latent untags by the latent's death fold, drop_below untags at the undercut, close's retirement resets — debug-asserted at each site. - heights fold into the register once per consumed delta: fold_height. - Wave 2's two load-bearing install-before-emission ordering comments are intact (fill.rs consume re-anchor arm; prescan record's tail). D7: the reigning-record expects reduce 6 -> 5 (the arm trichotomy's two collapse into the one mint-and-replace closure); the survivors document the cross-struct winner <=> armed invariant the API cannot carry while the winner stays wrapper-side. D8 on touched files: t -> gap, sig -> anchor_relative, d_arm -> arm_offset (one name with fill's consume site), rec -> reign, neg/off -> negative/offset, bridge_add_t/bridge_sub_t -> bridge_add_gap/bridge_sub_gap; no single-letter locals. PROBE-REPORT.md's two MinStack mentions are re-denominated to MinWeb (the no-ghost-references sweep). Gate: fully clean (fmt, doclint, testdoc, readme, clippy x2, both rustdoc gates, test-all, doctest, worst-cases-pin, fuzzfit, fuelscape-test, surface-totality, supply-chain).

Byte-identical behavior throughout: every deterministic meter reading and board cell is unchanged against the parent commit (captured and diffed at both scales of record plus the worst-case map), the worst-case pin reads clean (172 pinned rows verified at 2 scales), and the full gate is clean. Zero re-pins. Queued dedups and homes: - admit.rs: the collapsible-pair close-out lives once (close_ancestor), called from both step's backtrack loop and finish's drain — identical per-ancestor ops, loop shapes preserved. validate <-> admit cross-citations added in both module docs. - emit.rs: named module-level pick functions follow_max/follow_min replace the four duplicated side-selection closures across join, meet, and hull's emission table. - u32_digits moved integral.rs -> web.rs beside mul_into, its only consumer (verified fresh: WindowMass uses Limbs directly). - signed_sum_base becomes Signed::sum (it sums Signed values; "base" misled) — two call sites in fill.rs updated. - fill/fuse.rs Out::leaf unreachable: revisited and kept. Threading the builder out of diverge()/note_match() either relocates the panic (require_built) or dissolves the note_match/diverge vocabulary into a combined sink; the borrow topology that defeated Wave 2 is unchanged. D8 naming sweep (walk, build, validate, grow, text, literal, encode, decode, root, plus admit/emit residue): internal_nodes for every unary-run count; grow's left_present/right_present, path_depth, level, current, original, subtree, overshoot, events (the k parameter, with the module doc binding the paper's k to it); text's cursor/text/byte and merge's right_floor/lift for the derivation quantities; literal's left/right spelled-out topology and heights names; walk's negative/magnitude, Extremum register, net/min sign-magnitude names; emit's cursor_a/cursor_b, step_a/step_b, directions; admit's flip_lo/flip_hi. D7: no new conversions landed in the swept files — every surviving expect/unreachable is a contract panic or a cheap invariant probe, each considered site recorded in the campaign log. Doc re-aims: the retired name "watermark stack" re-denominated to the watermark web's terms at six meter-doc sites (meter.rs, registry.rs, board/family.rs, tests/meter.rs); skyline.rs's module doc gains the two-line machinery note pointing at overlay/watermark/signed.

The fill walk's at-height arm (`MinWeb<()>::emit_here`, pending frames open) routed through `arm_below` with a leased zero, whose offset computation folds that zero into the dying gap: one digit touch per arm bought nothing — `arm_at_height` moves the gap out whole with no fold and identical values. Wave 5 measured this exact routing and gated it out because the honest −1 touch per arm breaches four committed liveness floors from below; this commit takes the improvement and re-derives those floors premise-first. The falsified premise - The width-circulation `tick_run` one-per-byte floor claimed "the walk folds every consumed delta into the height accumulator" at one touch per input byte. The dimension was never mechanism-true: a fold touches one digit per 32-bit digit — one per 64-bit limb through `apply_limbs`, zero limbs included — so wide payload funds at most bytes/8, and the constant held only because the arm's no-op fold subsidized one touch per site. The leveled control (all-zero boundaries, the most sites per payload byte) exposes it: 1,438 touches on 1,651 input bytes. - The three ×0.75 floors it dragged under (pure_comb, ascend_cliff, ascend_cliff_plateau) were measured-basis floors whose basis included the same per-arm touch. Re-derived floors (from the improved walk's irreducible work, never the new measurements; margins are what the mechanism leaves) - tick_run (width_circulation): touches >= input/8. Every consumed code's magnitude folds into a live accumulator at least once, one touch per 64-bit limb, zero limbs included; in every family here the folded payload is at least an eighth of the packed input. Cleared: plateau 1,438 vs 206 (x7.0) small, 2,854 vs 412 (x6.9) large. - PURE_COMB_TOUCH_FLOOR = 2,030 = 2(k−1) + b/64 at (1,000, 2,048): each close-reveal cycle's arm pays the latent recycle's fold (>= 1 digit, a leased zero included) and the merged boundary's sign read; the wide plateau code folds once at one touch per limb. Cleared: 2,234 (x1.10). - ASCEND_CLIFF_TOUCH_FLOOR = 8,060 = 4(k−1) + b/64 at (2,000, 4,096): one fold per consumed nonzero unit code, one sign read per pushed boundary's arm, one domination read plus one dying fold per cascade hop, plus the wide cliff code's one fold. Cleared: 14,848 (x1.84). - PLATEAU_TOUCH_FLOOR = 2,063 = (k−1) + b/64 at (2,000, 4,096): one sign read per arm even at all-zero boundaries; the wide first raise folds once; the zero-run stack passes the final undercut whole. Cleared: 2,854 (x1.38). Re-pinned constants (old -> new; ceilings measured x1.25, unbreached floors measured x0.75, on the parent-measured new basis) - pure_comb ceiling 4,043 -> 2,793 (basis 3,234 -> 2,234), floor 2,425 -> 2,030 (derived, above) - ascend_cliff ceiling 26,060 -> 18,560 (parent-live basis 16,848 -> 14,848; the pinned 20,848 had pre-existing unowned drift), floor 15,636 -> 8,060 (derived) - PLATEAU_TOUCH_CEILING 6,068 -> 3,568 (basis 4,854 -> 2,854), PLATEAU_TOUCH_FLOOR 3,640 -> 2,063 (derived) - reveal_comb ceiling 122,131 -> 94,620, floor 73,278 -> 56,772 (parent-live basis 79,697 -> 75,696; pinned 97,705 was pre-existing drift) - HIFLOOR_TOUCH_CEILING 63,547 -> 51,042, HIFLOOR_TOUCH_FLOOR 38,127 -> 30,624 (parent-live basis 42,834 -> 40,833; pinned 50,837 was pre-existing drift) - memo_fanout ceiling 110,907 -> 90,902, floor 66,544 -> 54,540 (parent-live basis 76,722 -> 72,721; pinned 88,726 was pre-existing drift) Reading movements (parent 8bc1255 -> here, small / large; every one a whole-touch multiple of the family's arm count) - pure_comb 3,122 -> 2,122 / 3,234 -> 2,234 (−k) - ascend_cliff 8,432 -> 7,432 / 16,848 -> 14,848 (−k) - ascend_cliff_plateau 2,438 -> 1,438 / 4,854 -> 2,854 (−k) - reveal_comb 39,849 -> 37,848 / 79,697 -> 75,696 (−2k−1) - reveal_comb_hifloor 42,234 -> 40,233 / 42,834 -> 40,833 (−2k−1) - memo_chain_distinct 53,007 -> 51,006 / 106,007 -> 102,006 (−2k−1) - memo_chain_shared 37,022 -> 35,021 / 74,022 -> 70,021 (−2k−1) - memo_comb 36,519 -> 35,518 / 73,019 -> 71,018 (−2k−1) - memo_churn 52,021 -> 50,420 / 104,021 -> 100,820 (−2k−1) - memo_oscillating 507,465 -> 505,464 / 1,014,965 -> 1,010,964 (−2k−1) - descending_raises 40,031 -> 38,428 / 80,031 -> 76,828 (−2k−3) - tick scenario envelopes, inside their standing bands, no constant moved: tick_expand_cross 125,008 -> 125,006; tick_ownership_hole 6,050 -> 6,043; tick_mirror_wide 85,558 -> 85,557; tick_nested_wide 24,646 -> 24,645; tick_ownership_comb 125,020 -> 125,019; ticks_mirror_wide 86,059 -> 86,058; ticks_nested_wide 24,900 -> 24,899 (ticks_flatness endpoints follow, deltas 0) Board: only tick/ticks/clock_tick touch columns move (per-byte down; version_tick ascend-plateau's touch exponent display 1.00 -> 0.99); red counts unchanged (19 at scale 1 / 18 at acceptance, the pre-existing owner-triage set); worst-case map argmaxes unchanged (one runner-up ratio display); ranking pin clean with no re-pin (172 rows at 2 scales). Byte-identity: the full 776-test suite is green untouched — the tick/fill differentials against the recursive oracle, the exhaustive small scope, every snapshot pin. The change moves work, never values. The memo_resolution_cost module's own one-per-byte tick_run floor is unbreached (its families read 10x+ per byte on ledger folds) and keeps its constant.

…ink allows The rule: a skyline submodule is `pub` exactly where code outside the crate path-names it — the meter integration suite (`tests/meter.rs`) or any other external consumer. Verified by grep across `crates/before/tests/`, `crates/before/fuzz/`, `fuzzfit/`, `surfacecheck/`, the workspace root `src/`, and `crates/before-viz`: the module-qualified external reaches are `sweep`, `emit`, `query`, and `text` (the `encode`/`decode`/`validate` hits are this module's root functions), and nothing external names any machinery module. Demoted to `pub(crate)`: `place`, `fill`, `grow`, `literal`, `masked`, `overlay`, and `query::integral` (which also resolves the flagged pub/private machinery-module asymmetry: overlay+integral now sit with watermark+web on the private side). `skyline.rs`'s module doc names the demoted modules as plain code spans — the established pattern for its private machinery — and its machinery note now states the rule in one line instead of inventorying. `#![allow(rustdoc::private_intra_doc_links)]` roster, arbitrated by running both doc gates with every header removed and restoring exactly what fired: - Removed as dead (private containers; the lint cannot fire): admit.rs, grow.rs, overlay.rs, place.rs, masked.rs, query/integral.rs. - Kept, load-bearing (the public gate fails without them): codec/bits.rs (`Bits`/`BitsMut` docs link private `ptr_eq`/`canonical_eq`), sweep.rs (its doc links `super::overlay` and private `Directions`). - Added, load-bearing for the demotions: emit.rs (its doc cites `super::overlay`'s boundary-bookkeeping essay), query.rs (module and fold docs cite the `integral` submodule's essay). Zero behavior change and zero meter movement: visibility and doc headers only; the full suite is green and both rustdoc gates (public and --document-private-items, warnings denied) pass.

…s outright Owner ruling (2026-08-07, superseding the empty-buffer allowance): no expected-reds/accepted-reds mechanism may exist at all. A red board cell at a scale of record is unconditionally a gate failure until resolved — by a cure, or by an owner-declared model at the cell; there is no temporary normalization of deviance, so there is no buffer for it. Excision inventory (the mechanism and every consult): - meter/board/coverage.rs: the ExpectedRed struct and the BOARD_EXPECTED_REDS const (the buffer itself), with the module doc's buffer clause. - meter/board/coverage/tests.rs: the acceptance assertion expected_red_buffer_is_an_empty_triage_buffer and its import. - meter/board.rs: the pub re-exports and the declared-models section's buffer sentence, re-denominated to the unconditional criterion. - meter/registry.rs: the roster doc's intermediate-state bullet (a red cell with a live buffer entry was the sanctioned intermediate state; now there is none) and the adding-a-family checklist's buffer step. - testing/validation_index.rs: the board row's buffer sentence. - tests/amp_board_smoke.rs: the no-colors rationale, re-aimed at the gate's board leg. - examples/amp_board.rs: the verdict consult — the exit criterion was red count != buffer length; it is now red != 0 at the scales of record. - design/before-adversarial-resource-amplification.md: the status header, the red-doctrine decision record, the dashboard red-set section, the acceptance criterion, and §17.3, each restated over the unconditional criterion (the 2026-07-28 accepted-red ruling's doctrine survives; the buffer artifact does not). The demonstration this criterion exposes (measured at f1b24c0, release, one run per scale of record): 19 red cells at scale 1 and 18 at the acceptance scale — 14 causally_contains scan/touch floor reds, 4 ascend-cliff heap-constant reds (version_tick/version_ticks/clock_tick at 177.5 B/B vs the declared 158, version_min_ticks at 193.3 vs 177), and version_min_ticks/benign limb exponent 1.49 at scale 1 only. Their triage lands in the following commits; the gate's board leg is wired after the tree is green, with this red state recorded there as the instrument's catch demonstration.

…mily alignment Every red the unconditional criterion exposed at f1b24c0, diagnosed per cell before any number moved. Per-cell table (cell : genre : diagnosis : action : old -> new): 1-14. causally_contains x {cliff, comb-scatter, mirror-narrow, staircase, reveal-comb, reveal-hifloor, ascend-cliff, freeze-pos, promo-rearm, weight-comb, freeze-parade, lone-freeze, tooth-tail, benign} : FALSIFIED FLOOR PREMISE (not a dead meter) : the row shared comparison_floors(), whose premise — a distinct comparable pair must be walked to the end — is two-directional, while since(v).contains(w) asks one direction only. Probed every board family pair: all 13 red families' pairs answer TRUE (one witness event of w outside v decides; the fused filter::admits walk legitimately early-exits), and the one family whose verdict is FALSE (dense-suffix, w < v, full certification forced) reads green with honest full-walk numbers through the same kernel — the meters are watching; the premise was wrong. Cure: the new membership_floors() constructor forks on the shape of the answer the question forces, one universal premise, no per-family carve-outs: the query refusing w (w <= v) binds the full-examination scan floor and the per-overlay-boundary touch floor; the query admitting w binds the root-codes scan floor with touch not applicable; an equal pair binds neither (byte identity answers it). Floors moved; no reading moved. 15-18. {version_tick, version_ticks, clock_tick, version_min_ticks} x ascend-cliff heap constants : STALE FAMILY-STATED CONSTANTS, merged with the family alignment below into ONE restatement per cell. Two causes, named separately: (a) pre-campaign drift, bisected to its owning commit: 647494f "suanpan: quick register in front of the digit engine" moved the tick trio 123.8 -> 177.5 B/B and min_ticks 138.7 -> 193.3 in one commit (parent b79f482 still reads the declared profiles exactly; 647494f reads today's) — deliberate landed perf work (tick 1511 -> 1140 us in its own message) that re-pinned the envelope suite but not the never-gating board ceilings. Campaign-clean: readings byte-identical at the campaign base d249cee and at f1b24c0. (b) the ascend-cliff base alignment below moves every ascend-cliff operand ~-0.8% and the sampled capacity position, landing the profiles at 179.0 -> 181.1 (tick trio) and 194.8 -> 197.5 (min_ticks), measured release at both sampling scales, exponents exactly 1.00. Re-pin at the ratified worst-reading x1.25 rounded-up convention: ASCEND_CLIFF_TICK_HEAP_BYTES_PER_INPUT_BYTE 158 -> 227, ASCEND_CLIFF_MIN_TICKS_HEAP_BYTES_PER_INPUT_BYTE 177 -> 247. The derivations now also price the quick register and the certificate buffers' power-of-two capacity rounding, sampled at the position the family base fixes (measured: peak heap is a step function of the magnitude width with plateaus between powers of two — 248,672 B flat for widths 992..1023, 494,464 B flat for 1025..2047 — and the x2 ladder preserves the base's position in that period at every point). 19. rank_sum/ascend-cliff (touch) and the ascend-cliff exponent-window hygiene : FAMILY-GENERATOR ARTIFACT, repaired by the in-tree remainder-alignment convention (owner-approved): ASCEND_CLIFF_BASE 1000 -> 992 (= 31 x 32). Constructed evidence for the selector: the rank sum deposits each word-scale summand at bit offset (exponent gap) mod 32; a fixed-size sweep over wrap depths shows touch/summand flat at 1.002 for offsets 0..25, climbing 1.033/1.065/ 1.127/1.217/1.431/1.717 across offsets 26..31, exactly periodic mod 32 — and the family's own instances correlate exactly (rank exponent s-1: remainders 7/15/31/31 across knobs 1000/2000/4000/8000 match the measured 1.11/1.11/1.83/1.83 touch regimes). Six sibling families already pin their remainder by base choice (the freeze-position base's derivation); ascend-cliff was the one that missed it. 32 | 992 pins the remainder at 31 at every ladder point, and among multiples of 32 the base sits just below the 1024-bit capacity boundary, so the heap declarations above sample the buffers' rounding at its efficient edge (base 1024 was measured first and rejected: it lands exactly on the boundary and reads 277-279 B/B for the same work). rank_sum's touch constant now reads 1.4/B flat at every ladder point. (version_min_ticks/benign, the 19th red at f1b24c0, is a two-point-fit artifact over a sparse lumpy counter; its resolution is the estimator policy landing next in this wave, per the owner's full-ladder ruling.) Worst-map ranking pin: clean after the base change (172 rows, no near-tie flips). Prose in this commit's declarations anticipates the ladder vocabulary the policy commit formalizes.

…ne acceptance invocation Owner-ratified measurement policy: an exponent is a trend over all measured points, never a per-window ratio. The estimator is one log-log least-squares fit (judge::trend) across every point the run measured for the cell; through two points the slope is exactly the log ratio, so a single-scale debugging view fits as it renders. The verdict of record is run_acceptance: one invocation sweeps each cell's whole ladder — the two sizes at each of the two sampling scales — judges every constant, declared-model band, and liveness floor per size exactly as before-window semantics demand, fits each exponent once across the four points, and exits nonzero on any red cell; bare single-scale runs are views whose verdicts never bind. Ladder densification (measuring more points) is deliberately not part of the policy: it stays a case-by-case owner- invoked adjudication tool, and that boundary is stated on the estimator. Why: a two-point per-window ratio hands a verdict to a single generator lump. version_min_ticks/benign read limb e 1.49 at scale 1 (green 0.98 at acceptance) from a sparse, lumpy, intercept-scale counter — measured ladder 71:142, 102:174, 134:226, 213:424, 288:708, 427:638 (non-monotone), 549:860, 833:1546, 1117:1720 limb ops — a lump inside one window, linear across the ladder. Under the trend it reads e 0.90: green from its real four points, no cell model, no minted threshold, no new measurement executions. The trend is also strictly sharper where it matters: it surfaced rank_sum/ascend-cliff's cross-window regime flip that both per-window fits read as e 1.00 (triaged by the family alignment in the previous commit). Estimator stabilization, recomputed across all 2,014 cells at both sampling scales: exactly two cells' verdicts moved — version_min_ticks/ benign red -> green (above), rank_sum/ascend-cliff green -> red -> green (previous commit); every other verdict identical, no pinned constant moved by the estimator itself. Guards generalize faithfully: the denominator-span guard runs first-to- last over the fitted points; the capacity-model heap trend stays unjudged (banded instead); the heap fit drops sub-allowance points and judges only when two or more clearing points span a scaling denominator. The committed tripwire (acceptance_trend_absorbs_lumps_and_keeps_ amplifiers_red) pins both directions: the lump ladder's own first window reads over the ceiling through a two-point fit — the pre-policy red, demonstrated — while the four-point trend reads it linear, and a genuine quadratic ladder stays red through the trend in both windows. Invocation unification and re-denomination ride this commit: the acceptance judgment is one invocation (per-scale acceptance plumbing in the example retired), and "scales of record" retires as an evaluation concept — what exists is one measurement ladder feeding one trend fit plus per-size constant checks, with "sampling scale" surviving as schedule vocabulary (ACCEPTANCE_SCALE renamed LADDER_TOP_SCALE; DEFAULT_SCALE is the ladder's base; board docs, render and pin output strings, the worst-map docs, the bench sidecar's reference, and the design doc's acceptance criterion re-denominated). The bench judge's own two sampling scales are its instrument's schedule and keep their names.

The gate's board leg ran only worst-cases-pin, so the amp_board acceptance never gated — a process failure: the board's all-green criterion existed with no leg consuming it, and red cells sat invisible to every pre-commit run. The board stream now runs the acceptance invocation (the whole measurement ladder, one verdict, nonzero exit on any red cell) before the ranking pin; both are deterministic counters, so the stream stays load-immune and safely concurrent. The instruments ratchet's demonstration — this leg catches the pre-fix state (measured at f1b24c0, release, before the triage landed): amp-board: 1995 green / 19 red (2014 cells) [scale 1] amp-board: 1996 green / 18 red (2014 cells) [acceptance scale] with the red set: 14 causally_contains scan/touch floor cells (cliff, comb-scatter, mirror-narrow, staircase, reveal-comb, reveal-hifloor, ascend-cliff, freeze-pos, promo-rearm, weight-comb, freeze-parade, lone-freeze, tooth-tail, benign), the four ascend-cliff heap cells (version_tick/version_ticks/clock_tick at 177.5 B/B vs declared 158; version_min_ticks at 193.3 vs 177), and version_min_ticks/benign (limb exponent 1.49, scale 1 only). Wired after their triage and the estimator policy landed, so the leg arrives green; the readings above are the recorded proof it reads red on the state that motivated it. CI's instruments job drops its separate default-scale board step: the acceptance invocation measures and judges the whole ladder, so the per-scale step pair collapses into the one verdict leg beside the ranking pin, matching the gate.

Four summaries from the ladder-policy commit rendered past the 220-char budget (the acceptance sweep, the window judgment, the acceptance cell judgment, and the exponent-ceiling resolver); each keeps a one-line summary with the rest below the fold. The acceptance entry point's doc cites the private judge seam it drives, so the shard module carries the private-intra-doc-links allow (load-bearing: the link is the rename detector, resolved by the internal-docs gate).

Land sturdier forms of every guarantee the trybuild compile-fail suite pins, beside the code that carries them, so they guard every build of the crate rather than one test binary's stderr snapshots: - static_assertions pins beside the type definitions: Party/Clock: !Clone + !Copy (Identity Linearity, the crate docs' second safety rule), each doc'd at the definition where a tempting derive would land. - The Clock join matrix's shape pinned beside the matrix: positive asserts that Clock (by value) carries BitOr<Version>/BitOr<&Version> with Output = Clock, and negative asserts that no Clock-Clock cell exists in any borrow shape and no impl is carried by &Clock. Together with !Copy these entail the use-after-move rejection: | moves its clock, and the compiler rejects any later use. - Paired doctests on both From impls (the balanced array splits): a compile_fail,E0080 twin at N = 0 beside a runnable twin at N = 1 with identical spelling except the arity — the pass twin is the adequacy guard proving the spelling compiles, so the fail twin can only be failing for the arity reason. The N >= 1 contract is now user-facing rustdoc (a headed section on each impl). Doctests fully build, so the post-monomorphization const assert fires under them; verified on both the stable and the pinned-nightly (merged-doctests) legs, where the E0080 annotation is code-checked. Ratchet demonstrations (each mutation applied as a reversible edit, restoration verified by clean git diff; the old suite is deleted only in the follow-up commit, after these reds): - derive(Clone) on Party -> E0283 at the party.rs assert_not_impl_any (ambiguous AmbiguousIfImpl), build fails; reverted. - derive(Clone) on Clock -> E0283 at the clock.rs assert, independent of the derive's own E0277 on the Party field; reverted. - impl BitOr<&Clock> for &Clock (minimal sketch) -> E0283 at the &'static Clock assert_not_impl_any block; reverted. - Party's N >= 1 const assert neutered -> the Party compile_fail doctest FAILS ('Test compiled successfully, but it's marked compile_fail') while the Clock twin stays green under its own assert; both neutered -> both twins FAIL; reverted.

Every guarantee the suite pinned now lives in-tree (the parent commit), demonstrated red-under-mutation before this deletion — the instruments ratchet, applied to the instrument's own retirement. What dissolves with it, each verified sole-consumer first: - tests/compile_fail.rs and tests/ui/** (six fail cases, six stderr snapshots, the build-forcing pass case — its monomorphization-forcing role now inherent in doctests, which fully build). - The trybuild dev-dependency and its unique subtree in Cargo.lock. - The rust-src toolchain component (rust-toolchain.toml, ci.yml): its only purpose was letting rustc quote std source into the stderr snapshots. The toolchain-file comment, AGENTS.md's one-time-setup paragraph, and ci.yml's component list are re-denominated. - The stderr re-blessing ritual and its rustc-version sensitivity: the replacements pin guarantees, not diagnostic renderings. (Recorded loss, owner-accepted: the snapshots incidentally checked diagnostic rendering quality; nothing pins that now.) The coverage inventory re-points: surface_coverage's exclusion-families roster and oracle.rs's linearity note now name the compile-time pins (static_assertions beside the definitions and the join matrix, the array-split compile_fail doctest twins) as the owners of linearity and aliasing mechanics. This also removes the tree's only stderr-snapshot-sensitive leg: the gate never touches RUSTC_WRAPPER, and runs natively under kache.

…ixes Per the five fresh-eyes syntheses (skyline-restructure-reviews/): - verdicts #1: filter.rs finish gains the division-of-labor doc (settled pairs' refutations live in full_possible or are the favorable answer; the !live guards keep finish off stale directions). Chose the comment over making Pair::relation refuse when !live: finish's emptiness arms legitimately read settled pairs' relations, and an Option-refusing relation would conflate settled with concurrent. - verdicts #2: admit.rs Errors bullet corrected toward the code ("false verdict" -> the Refuted verdict), and Admission::Refuted's variant doc now carries the height-invalid routing hazard. - verdicts #3: the coverage walk's hole arm states the transitivity license (missing the minimum is missing everything: lo <= v <= bound forces lo <= bound). - streams #3 (F4): parse's O(n) production-path self-revalidation deleted per the recompute-and-compare ruling. Coverage check done first: every accepted text maps (up to digit spelling) onto the canonical-version space the render<->parse inverse pair and the transcoder differential sample, so no input reaches the validator that the committed suites do not cover. Doc re-denominated; a one-line comment states what pins validity. - tick (beyond-legibility): ReignWeb::close counts the close on each live outcome after the dispatch, so the impossible Pending state counts nothing in release. Call sites audited (query.rs min_ticks loop; web.rs drain): the increment lands on the same pre-close reigning record on every live arm — behavior identical on all valid inputs. - tick F10: the route key's three spellings now carry one convention comment ("the branch's route key: Route's convention, the bit position of the branch's 2-bit id tag") at fill.rs, fuse.rs, grow.rs. - foundations #2 (#4): negative-zero re-audit — no producer exists. Every construction normalizes: unzigzag (odd => magnitude >= 1), from_sign_magnitude (suanpan's sign_magnitude ties zero magnitude to Equal), signed_sum/signed_sum_int (cancellation => positive zero), literal negative:false sites. signed.rs restates the tolerance as deliberate slack, positively. Meter movement (all from the parse-revalidation deletion; parent 735fc76 measured by reversible restore, aarch64-apple-darwin, dev profile for envelopes, release for the board): - skyline_parse_dense: scan 750_012 -> 375_006 (limb/heap unmoved) - skyline_parse_bigroot: limb 41_885 -> 41_259, scan 220_018 -> 110_009 - skyline_parse_hugeleaf: heap 137_152 -> 121_984, limb 5_863 -> 3_909, scan 500_004 -> 250_002 - skyline_parse_cliff: limb 45_250 -> 45_180, scan 28_676 -> 14_338 - delegating-parser pipeline limb totals: hugeleaf 752 -> 501, bigroot 8_385 -> 8_259; floors re-derived at x0.85 over the two-site pipeline (639 -> 425, 7_127 -> 7_020), separation re-checked over the bypass readings (251, 4_132). - WORST_RANKINGS touch flips (parse touch density re-ranked once the per-parse work is the build pass's own): version_from_str default staircase -> reveal-comb, acceptance staircase -> comb-scatter; clock_from_str both scales concurrent-pair -> comb-scatter. Board acceptance 2014/2014 green; worst-cases pin clean (172 rows at 2 scales); full -p before --all-features suite 775 passed.

…ument naming Prose/structure only; zero behavior change; zero meter movement (full suite 775 green, board 2014/2014 green, worst-case pin clean at both scales). Per the five syntheses plus the narration-delta relay block. Vocabulary minting (the campaign's dominant friction genre), applied on prescan.rs's italicized-first-use model: - *plateau* minted in skyline.rs where the step function is introduced (tick F3; overlay.rs's layer-local definition stands). - *left-full site* minted in fill.rs's module doc beside the arms, with the narration's full-child ground-truth sentence (relay 5); memo.rs keeps a back-reference (tick F3). - *min-into-max* minted at watermark.rs's first use with the merge_into_wider gloss (integral F6, tick F3). - *priced by* minted once in overlay.rs's Cost section (foundations vocabulary finding) and made reachable from watermark.rs's cost bullet (relay 3 — the tick reader's independent stall). - *range*/*frame* reconciled by a dual mint at watermark.rs's first use (a range is the client's bracket; the web holds one frame per open range). Deviation from the charter's "pick one": the narration delta's C2 repackage-don't-rewrite constraint and the relay-8 guard protect praised sentences spelled in both words; the dual mint reaches the same goal (no reader wonders whether they differ) without rewriting them. - height-split components B/P/L and F/L named in query.rs's split section (integral F1); "both width currencies" named as touch and limb (integral F4); judge.rs's ladder axes fixed as sampling scale x size and used consistently (integral F9), with the sparse-lumpy errs-red direction stated at trend (integral F10). Thread and aim repairs: - integral.rs P-bullet re-cut with the forward link to the promotion ledger and Integrator::frozen (integral F2); ledger-settle bullet split into funded sub-bullets (integral F3); Complexity address re-aimed at Version::{rank,distance,lag} with rename-protected links (integral F5). - query.rs min_ticks bullet redeems the closes-count koan with the web-submodule pointer (relay 4). - grow.rs +k compounding names fill's raising mechanism (streams F1). - text.rs merge doc gains the frame-free identity lift = floor(right) - floor(left) (streams F3); the parse bullet glosses *top*, splits the pin sentence, and states the schoolbook twin's role plainly (streams F2). - walk.rs's claim scoped to the single-stream leaf passes with two-way cross-links to overlay's LeafCursor; no structural unification (foundations #1). walk added to the root doc's machinery tour; literal/walk mod declarations gain one-line comments (foundations #3). - masked.rs roster states what step's code shows — mask slots free, A/B relative order the one committed-reading freedom, order arbitrary-but-pinned (foundations #6, transcription form per relay 10). - watermark.rs gains # The arming paths (three entry points, preconditions, first-arm capability — tick F4) and emit_offset's five-path map with the deliberate non-restore named (tick F5); followers get the purpose/deferral sentence (relay 9) and the anchor-relative story its park() pointer (relay 7). All praised sentences preserved verbatim (relay 8 guard; C2). - place.rs module doc states the probe-is-every-pair's-a orientation up front (relay 2); walk's doc states the flatten drop/finish agreement obligation and all three flatten callers carry their per-verdict argument (relay 1 — the delta's top latent finding). - fill.rs IdNode::Empty arm upgraded to the reachability + mechanism + keep-rationale model (relay 6). Cursor-set unification (verdicts seed-dispute): filter.rs's MemberCursors/SpanCursors now own their walk state (probe/endpoint cursors, live flags, sides) exactly as place.rs's Cursors — the borrow checker allowed it without contortion; the read loops reach the sides through the fields. masked/place shapes untouched (the delta's C4: their difference is principled). Write sequences unchanged; placement identity rows and the full board byte-green. Instrument naming (tick #1, F1): the two lower-bound genres are named apart file-wide in tests/meter.rs — derived *liveness floors* (trip = the mechanism's irreducible work left the metered representation: investigate) vs measured-x0.75 *improvement tripwires* (trip = the reading dropped >25% below the pin: attribute and re-pin). The file doc mints both; HIFLOOR_TOUCH_FLOOR -> HIFLOOR_TOUCH_TRIPWIRE, reveal_comb's inline bound -> REVEAL_COMB_TOUCH_TRIPWIRE, envelope column docs and every trip message re-denominated to their genre. PURE_COMB_TOUCH_FLOOR and ASCEND_CLIFF_TOUCH_FLOOR keep the liveness name they already earn. memo_resolution_cost::tick_run floor (tick #2/F2): re-derived premise-first to the reveal module's per-limb structure — one touch per 64-bit limb of every consumed code's magnitude, with the family premise stated (folded payload at least an eighth of the packed input). Constant old -> new: one-per-input-byte -> one-per-eight- input-bytes (the old x1 was a per-delta derivation asserted per byte, subsidized by narrow-delta families). Readings unmoved; the floor is a liveness check, not a tightness contest.

Owner counterweight (dissolve/link/mint, per term — binding ruling applied retroactively to the T2 lexicon): - min-into-max: DISSOLVED — every site now names suanpan's merge_into_wider plainly (the narrower buffer folds into the wider), linked once at the close bullet. - range/frame: resolved by DELETING "frame" from watermark.rs — the web's word is now "range" everywhere (prose, field docs, assert messages); "range" keeps its one definition (the client's bracket, never interpreted by the web). fill.rs's one "watermark frame" phrase re-denominated. - plateau: LINKED — overlay.rs's tiling vocabulary keeps the one mint; skyline.rs carries a plain gloss naming overlay as the minting site (a public->private intra-doc link cannot resolve on the public build). - "both width currencies": DISSOLVED into "both the touch and limb counters". - B/P/L and F/L component names: LINKED — named plainly in query.rs with the pointer to integral.rs's existing mints, no re-mint. - priced/paid-by, left-full site, settled (filter.rs), liveness-floor/improvement-tripwire: MINTED (each spent widely enough that per-use restatement costs more; the first two per the owner's own examples). - full child: LINKED to IdNode::Full (the API's own name). Polish implemented (by synthesis numbering): - foundations #5 (walk.rs/overlay.rs internal Panics sections adopt the precise truncation/malformation-vs-silent contract, pointing at causal_cmp's canonical statement), #7 (Extremum reset-policy comparison + provenance contract, grounded in the pool's clear-on-retire), #8 (CursorSet absent-slot lemma written out; priority's commutative-sums freedom stated), #9 (GAMMA_SMALL_MAG_BOUND named with its derivation, both twins), #10 (root-doc micro-frictions: first sentence, zigzag letter d vs code-shape k, gamma-covers-zero clause, codec-cursor reference), #11 (Step vs Signed distinction), #12 (block-scan honesty leads the skip docs), #13 (overlay layer-map sentence split), #14 (numeric flip<=depth restatement), #15 (IdLeafCursor pop-flip survival comment + idbits packed-coding pointer), #16 (advance's unexhausted precondition), #17 (sweep early-exit Break-carries-V reworded); delta latent items: the advance dual-channel why (callback = order, return = crossings), masked.rs Directions::relation link. - verdicts #6 (admit.rs "placement walk's idiom" misattribution dropped at both sites — restated-not-reused, fallibility argument kept), #7 (masked height integrators fold plainly via fold_signed_int; the Side::A polarity pun and its rescue comments gone), #9 (settled minted at Pair::live), #11 (end-first arbitrariness stated), #12 (trichotomy glossed as the comparison trichotomy), #13 (/* negative: */ argument comments at the literal seeding sites, uniformly), #14 (validate.rs first-leaf zero_delta defense), #15 (admit.rs rewrap), #16 (subsumption's pointwise no-block-skipping premise), #17 (filter.rs Cost names the per-interval bookkeeping scans); delta: Demand::After/Before inclusivity reminders at both downstream re-check sites. - streams F5 (grow Phase 2 absolute-code case), F6 (emit sticky-tie seed comments + placeholder note), F7 (build absorb-pop lens comment), P1 (re-anchor gloss), P2 (delta_code takes Option<&Step>), P3 (merge per-step comments). - integral P1 (one's why-a-field), P3 (pair_fold unwrap_or(1) declared unreachable-but-total), P4 (feeds garden path resolved in the Cost list), P5 (rank Cost paragraph as a charge list + the four-structure map sentence), F7 (top-index domination appositive), F8 (forward/ reverse dual names dropped for plain statements), F11 (jump-pair family named at the jump-comb parenthetical), F12 (carry-cliff and comb-teeth glosses), F13 (resolve_latent's caller obligation stated abstractly). - tick F6 (one-web-range-per-Frames-entry comment at the single close), F7 (FillWalk/PreScan field stack -> web, matching query/web.rs), F8 (Relation::Min <-> REL_FOLLOWER invariant on the type), F9 (FOLLOWER_SLOTS pub(super) + const assert binding the slot roster across files), F14 covered by the propagate doc's existing narration (loop-invariant comment deferred: see report), F15 (level-vs-depth caution at the twin declaration), F16 (level-0 keeper exemption), F17 (recorder invariant block), F18 (replay_max why-not-park), F19 (the twelve-line measurement roster reduced to claim + pointer), F20 (close() doc: fill discards the outcome entirely; min-ticks dispatches all four arms) [in close()'s payload sentence], F21 (emit_offset's constant-true note_match as a debug-asserted match), F22 (Out::leaf # Panics heading), F23 (copy_subtree regime map), F24 (compact()'s two-digits-cover-a-u64 derivation); tick polish: the two precondition-shaped assert messages restated as invariants, materialize's sign() collapse idiom matched to the explained spelling, walk()'s derived-depth comment, emit_step's deliberately- unread step comment, RouteProbe's Cost::MAX-as-don't-care and id_span fallback notes, the watermark representation paragraph as a list with the derivation sentence standing alone (relay-8 guard honored), the undercut bullet as sub-bullets, the cost essay's first-read gate, new()/compacting() pointing at their committed families, ascend-cliff floor's created/penetrated split, both derived floors scoped to their mechanism with the floor-premise escape stated. Zero meter movement: full suite 775 green, board 2014/2014 green, worst-case pin clean (172 rows, both scales), clippy clean on default and --all-features. validate_bits gated to test/meter (its production consumer is gone), keeping the default build warning-free.

accumulator/tests.rs (2,046 lines) becomes a shared harness (fresh, oracle_sign, assert_value, from_limbs) over four themed submodules: - tests/differential.rs: the oracle proptests and deterministic adversarial streams; - tests/metered.rs (touch-meter builds): the exact digit-touch pins behind the claims roster, tripwire included — every OWN witness the roster cites lives here, and the claims OWN path moves with them; - tests/witnesses.rs: the constructed tight-corner witnesses (decision thresholds, register headroom extremes, conversion corners); - tests/ledger.rs: the exhaustive and randomized ledger-invariant drivers. The committed proptest seeds move with their tests: the regression file is relocated to tests/differential.txt and duplicated to tests/ledger.txt (seeds replay per-file; the three committed cases' (arm, limbs, shift) shape is drawn by the run-forming strategies in both files), never stripped. New coverage: pooled_reuse_after_reset_matches_the_oracle pins the reset -> re-spill seam end to end (a second stream spilling into the retained buffer sees no residue) — the seam enter_digit_engine's idle-buffer debug_assert guards, previously exercised only up to the reset itself. Naming pass over the moved code (no single-letter identifiers): x/y -> receiver/operand, k/n/w/d -> cliff_bits/pairs/tooth_bits/ held_digits and kin, ledger_dfs a/o -> next_acc/next_oracle, closure binders spelled out. Two standalone-constraint repairs in test prose: witness docs no longer name a consumer crate. Oracle: suanpan 48/48 (one new test); before 775 passed as at the wave base; no non-test code touched.

…gate loop invariant + deferred zeros flush) — the two doc comments the T3 message named

…ary + body (content unchanged)

Naming (no public item touched; behavior-free): every single-letter code identifier spelled out — register values v/ov -> value/ operand_value/held, consume_run_at's t -> above, touch's n -> count, enumerate indices -> offset/limb_index/def_line/scan_line, closure binders (digit, cell, line, character, error, cited) throughout accumulator.rs, limbs.rs, touch_meter.rs, claims.rs, claims/tests.rs. Paper notation (|d|, |s|, |x|) survives only in prose quoting the bounds. merge_into_wider takes 'mut other' directly instead of rebinding. Assertion audit: read_magnitude's debug_assert — an O(skipped-prefix) all-zero rescan of exactly the region the watermark skip exists to avoid, on every dev read-out — is retired per the recompute-and- compare ruling: the invariant it sampled unsystematically is held deliberately by the ledger-invariant suite (the write-watermark clause, after every step of every exhaustive and randomized schedule) and by oracle value agreement on every differential stream; the fn doc now cites that coverage. The surviving debug_asserts are O(1) or once-per-epoch discipline documentation; the four shift-position expects are documented contract panics. Also rewraps the two overlong # Complexity lines on the shifted-word entry points. Oracle: suanpan 48/48; before 775 passed; worst-cases-pin byte-identical (172 rows, rebuilt binary).

Prose only — no code changes. The gaps, each stated in suanpan's own terms: - Metering (crate page + touch_meter module doc): the quick register's touch accounting is now stated — a delta, sign query, negation, or shift the register absorbs counts exactly one touch, a register read-out counts the value's digit_count, the spill prices only its few-digit deposit — and the exact-count semantics are declared a public contract (a fixed operation sequence yields a deterministic reading; changing any operation's count is a breaking change, never noise). - reset: the honest cost fork is on the doc — a reset scans O(|self|) to keep the allocation, a fresh new() is O(1) and drops it — with the decision rule (will the capacity be spilled into again?). - merge_into_wider: why the bound is amortized — a nearly-cancelling merge zeroes the receiver's top and the settlement scan spends credits prepaid by the writes that built those digits (the ledger argument). - Accumulator type doc: the Complexity section no longer states the Clone/Debug pricing twice. - Two mid-sentence wrap artifacts repaired (the representation section's 'If t is in the zone', the Interop lock sentence); one test doc summary brought under the doclint budget. README re-derived via just readme (no hand edits). Oracle: suanpan 48/48; before 775 passed; doclint/testdoc clean; worst-cases-pin byte-identical (172 rows).

The last single-letter code identifiers: the magnitude dispatches' Some(n) -> Some(word), the claims table binder's row indices, and the integration harness's touches(f)/a/t/n -> metered/acc/grid/rounds. Standalone prose: suanpan's own text no longer names its consumer — the claims module, its binding tests, and the amortized-sequences essay now say 'the sibling meter suite the BANDS path names'. The BANDS path string itself stays: it is the mechanical citation the witness-existence check resolves, and the one workspace-relative reference in the crate (flagged for the owner). Oracle: suanpan 48/48; doclint clean; no non-doc behavior touched.

Disjoint file sets: skyline campaign touched crates/before + workspace config; suanpan campaign touched crates/suanpan only. Both sides gated green independently at their heads (kache-native; board byte-identical on the suanpan side, zero re-pins).

The rewrap across the skyline module's doc comments and code comments is the owner's own work; this commit lands it as-is. Mechanical repairs applied: none. The rewrap moved line breaks only. Verified by construction rather than by inspection alone: - word-sequence equality: every removed/added block in the diff normalizes (comment prefix stripped, whitespace collapsed) to an identical token sequence, so no word was dropped, duplicated, or transposed; - comment-only: no non-comment line changed; - markdown block structure: doc lines segment into the same leaf blocks with the same joined content as before, so no continuation line became a list item, heading, blockquote, indented code, or table row; - link integrity: no intra-doc link is split between `]` and `(`, the one break markdown drops silently; - rendered output: the two code spans now folded across a line break (`|D'| <= |dD|` and `Theta(log |v|)` in query/integral.rs) render as single code spans, no table is emitted, and no docblock in the module tree contains a stray backtick; - no line exceeds 80 columns; no trailing whitespace or doubled space at a join point. Gate legs green: fmt-check, doclint, testdoc, readme-check, clippy (--all-targets --all-features, warnings denied), docs, docs-internal, doctest. The doclint reading was checked live, not vacuous: a deliberately de-indented list continuation in skyline.rs drew clippy::doc_lazy_continuation, and the mutation was reversed to a byte-identical tree.

Mechanical: the README is derived from crate-level rustdoc (cargo-rdme); the rewrap moved line breaks only (verified by normalized word-diff).

Replace the skyline currency's loose `negative: bool` vocabulary with a two-valued `Sign` enum (`Positive`/`Negative`) in version/skyline/signed.rs, so polarity puns are unwritable. Zero stays a zero magnitude under `Positive`, exactly the coding's convention; the accumulator's three-valued `Ordering` reads map down at the seam (`Signed::from_sign_magnitude` keeps its `(Ordering, UBig)` signature), and suanpan is untouched. Conversion families: - signed.rs: `Signed.sign`, `zigzag_signed`, `unzigzag`/`unzigzag_base`, `fold_signed`/`fold_signed_int`, `gamma_code_signed`(+`_int`), `signed_sum`/`signed_sum_int`; helpers `from_is_negative`, `is_negative`, `negate`. - overlay.rs `Step.sign` and `fold` (orientation applied as `sign`/`sign.negate()` per side); walk.rs `Extremum::fold`/`fold_armed` and `fold_region`; watermark.rs `fold_height` and the emit/arm/compare family; fill.rs/prescan.rs consume/fold/emit paths; emit.rs `delta_code`/`switch_delta`; grow.rs `recode`'s delta sign; query.rs rank/min-ticks/project folds; web.rs `Reign.sign`, `ReignWeb::leaf`, `EpochLedger.drifts`, `mul_into`'s balanced-digit terms; integral.rs `charge_segment`/`charge_digits`/`WindowMass::charge`, `Arming.sign`, `Integrator::open`; admit, validate, literal, place, place/filter, masked, text; the eight `/* negative: */`-annotated literal folds now spell `Sign::Positive`/`Sign::Negative` directly. Tuple-return dispositions: the unzigzag family and `signed_sum` stay tuples (`(Sign, Int)`/`(Sign, Base)` — consumers immediately fold or repackage, and `Signed`'s magnitude is `Int` where these carry `Base`); `signed_sum_int` and emit's `switch_delta` return `Signed` (their consumers hold the pair as one quantity). text.rs `Summary.span`/ `.incoming` become `(Sign, Base)`. Deliberate keep-as-bool (not quantity signs): - web.rs `mul_into(subtract: bool)` — operation selector (add vs remove the product from a running total). - grow.rs `recode`'s `increment` — height-stepping direction derived from the `Step` selector enum, which is itself untouched. - integral.rs `jump`'s local `negative` (and its test mirrors) — a local predicate branched immediately, never crossing a signature. - emit/tests.rs helper `fold_signed(subtract: bool, ...)` — orientation of a stream within a difference; the step's own sign now composes via `Sign::negate`. - codec/base/tests.rs generator tuples — add-vs-sub op selectors at the suanpan seam, below the skyline currency layer. Behavior is byte-identical: full suite green, board acceptance and the worst-cases ranking pin unchanged, no meter reading moved.

plaidfinch added 30 commits July 31, 2026 02:14

r141 audit witness: before-viz fragment decoder shift overflow (hosti…

3cb4417

…le varint)

plaidfinch added 29 commits August 7, 2026 10:44

Wave 7 T3 addendum: tick F20 (close outcome clientele) and F14 (propa…

02e1be9

…gate loop invariant + deferred zeros flush) — the two doc comments the T3 message named

Wave 7: doclint conformance — split nine long doc summaries into summ…

b4f3656

…ary + body (content unchanged)

Rewrap suanpan's lib.rs

bf95fdf

suanpan: re-derive README after the lib.rs rewrap

beb9926

Mechanical: the README is derived from crate-level rustdoc (cargo-rdme); the rewrap moved line breaks only (verified by normalized word-diff).

plaidfinch merged commit cead4bc into main Aug 8, 2026
1 of 2 checks passed

Navigation Menu

Uh oh!

Finally land the `before`-hardening campaign - #10

Finally land the `before`-hardening campaign#10
plaidfinch merged 973 commits into
mainfrom
before-hardening

plaidfinch commented Aug 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

plaidfinch commented Aug 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant