Marks

commit bcde0df Ore's command line moves onto fe2o3_syntax (ore master 56abd5e). The syn branch brings the argv driver, Val and Arity, and paged help pages; on top of it, a message's words stay words, -- ends the options, an unknown verb names the app's help command, and a command's name on the wire still fills a value that is owed, so REPL and wire parsing are unchanged (12,545 lines compared against 04a9319). Callers migrated in the same window: daimond main 4271a973, oxegen master 5c2bb52, elearnity and oxesim2 (checked clean), oxesim and powls (patched; both were already broken for unrelated reasons). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X77Eb36vcie9zk2bf6oBMr

commit 04a9319 fe2o3_core. The non-unix save_secret fsyncs its temporary file before the rename, as the unix one does. restrict_secret returns the mode it narrowed a file from, or None when the file was already its owner's alone, so a caller can tell its user; it still warns. Existing callers are statements and are unchanged. Consumed by ore, whose signing keys are now written through save_secret (a crash mid-write no longer loses the old key). QA (keys_report_20260924.md): core file:: 5 -> 6; fe2o3_net and fe2o3_steel build; x86_64-pc-windows-gnu check; ore 400 -> 402. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X51QriBAsPx88T3JxFR8sU

commit 22fe036 fe2o3_o3db_sync. A read checks the key and stamp in place against its cache entry, retrying up to eight times, then fails loudly tagged [Data, Mismatch] rather than return a same-sized record of another key that a collection moved (F1). The collection's move map is keyed by RecordDigest, not by offset (F2). While the disk is failing, syncs share one barrier under both interval and every-n policies (R1). A shutdown timeout never destroys queued messages (R2); start-up is guarded by catch_unwind (R3). A write that was appended but could not be confirmed durable carries the new ErrTag::Unconfirmed (R4, fe2o3_core). Close runs in stages: readers, scans and collectors; writers and syncers; cache; files; zone and config (a close under read load took 38.7 s, now 4.0 s). Adversarial QA twice (o3i_qa_20260924.md); re-tested after merging origin/main 55a4ca4: o3db 40 passed, sweep x2, main, oregami 54/54. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X51QriBAsPx88T3JxFR8sU

commit 55a4ca4 take_line read a chunk-size or trailer line with no length limit and rescanned the whole buffer on every fill. Steel's HTTPS reader has no timeout once the headers are in, so one chunked request that never sends a line end grew without bound. A chunk-size line is now capped at a fixed HTTP_CHUNK_LINE_MAX (its own shape bounds it regardless of any configured limits); a trailer line is capped at max_header_bytes, the same bound already applied to the header block it is one more field of. Either overflow tags TooBig, so https.rs:981 answers 413 instead of growing the connection's memory forever. take_line also now scans only the bytes not yet searched (plus one byte back, for a CRLF split across a read) instead of the whole buffer each pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SfPdMK6Q9DVi97WEvkHX37

commit af00b52 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CwmZoGMPqSJ45iDEiy4VNb

commit bae931c fe2o3_o3db_sync. A write is answered Written once appended, then durable under the sync policy (DURABILITY_TIMEOUT, 120 s); a slow disk no longer reports a landed write as failed. The barrier runs on a syncer per writer. start waits for every zone to survey and cache, bounded, and a failed start stops its bots before returning. Writer, zone, file and cache bots answer errors on the caller's responder. The collector reconsiders a file when it is sealed and when its last record lands, and in-bot supersessions go through the collection buffer. Callers draining a store's responder by hand must allow for Written: use Responder::recv_store_ack. Adversarial QA twice (sto_qa_20260923.md): o3db 36 passed, oregami 54/54, ochre index 33/33; fail-first on every new check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DGGd317J7RTRrLjkELNEQT

commit 63c8f30 fe2o3_net::presentation (request, presentation, head, invoice and settlement shapes; the relying party's verifier over strict Ed25519 and linkring/1), ring behind a default feature, WebAuthn EdDSA on the strict verifier, NonceTracker moved from Steel into guard::nonce and holding a pair to max(stamp, now) + window, strict unpadded base64url in fe2o3_text, and Dat::json_canonical_without and Dat::decode_json_strict in fe2o3_jdat. Audited, with the audit's fixes. Correction to the U2 commits' claim: net's mode2-only fe2o3_crypto dependency keeps pq's C code out of a wasm32 build only. Natively fe2o3_iop_db still takes crypto with its defaults, so a native build of fe2o3_net still builds the C code and the jent_entropy link fault still needs its own fix. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CwmZoGMPqSJ45iDEiy4VNb

commit e588fef Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AJRTmhnm7JUWkKtLR7dGZ8

commit bced70e

commit c2deb89 One-out-of-many proof (Bootle et al., radix 16) over ristretto255 with a tag tau = k*H_p(scope) bound to the signing key. 2,945 B at 10^6 keys, 3,489 B at 10^7; verify 3.1 s at 10^6 on one thread, 0.47 s on eight. Tested against an independent Python oracle (vectors and live), with each verify check proven necessary by an attack test. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rw9X9iWwNUarckMQx1eS1

commit 5564632 A bare launch shows the native open-file dialog (rfd, gui feature only, xdg-portal backend so no GTK is linked and the glibc-2.39 cross-link holds); a document path with no subcommand opens it directly, as a file association passes it; `open` with no path asks through the same dialog. A desktop-launch failure is shown in a message box as well as on stderr. `pearlite register` associates .prl for the current user: on Linux a shared-mime-info package, a pearlite-reader.desktop entry with a quoted, escaped Exec, cache refreshes (optional) and xdg-mime default (required); on Windows HKCU\Software\Classes through reg.exe, so no unsafe. It is a plan of steps built before anything is touched, then executed. A second binary, pearlite-reader, is linked for the Windows GUI subsystem and does only the desktop launch; register on Windows points the association at it when it sits beside pearlite.exe. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwVhDWVYEX9kDiagwbKzyc

commit d6ad1fe Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rw9X9iWwNUarckMQx1eS1

commit a9a9e56 Compares native austenite against typst compile -j1/-j16, and, where Daimond's vendored wasm exists, Austenite wasm against typst.ts wasm in node, on the crate's samples plus a generated synthetic document. Every run is capped (systemd-run, MemoryMax=3G) and timed with /usr/bin/time -v; host load (loadavg + PSI) is read before and after each run and a run made under load is flagged. aggregate.py refuses to report a batch containing a flagged run as a baseline unless forced. austenite --timings (U9) has not landed; speed_bench.sh detects that from source rather than probing the binary, since an unrecognised flag is silently taken as a positional path by austenite's argument parser. Edit-latency times Austenite's compileProjectDelta against typst.ts's real Daimond wiring (a full recompile to `vector`, not incr_compile/ IncrServer, which Daimond does not call anywhere) -- see the README for what that excludes (the browser-only render_svg DOM step). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bi5iALpcJRKNKpw7eQSV64

commit db4e325 qc_dir() was one literal path (~/.cache/austenite-qc-rc5) shared by every worktree of this crate. The fleet routinely holds a dozen-plus such worktrees at once, each its own lane, and each one shared this same directory -- so two lanes compiling the same corpus root concurrently wrote and read the SAME <root>-ledger.json and the same document.pdf. This is the harness race that made the m1-ledger-order fix's own verification run read back in plain identity order even after the fix had landed: the binary was right, the shared cache was not. qc_dir() now derives its path from an FNV-1a hash of CARGO_MANIFEST_DIR (the crate's own directory inside its checkout, hashed with the same mixing AnchorId::address uses), under ~/.cache/austenite-qc/<key>, with an AUSTENITE_QC_DIR override for a caller that wants one explicitly. expected.json is untouched -- it is read straight from the crate's own tests/oracle/ tree, never through qc_dir, so it stays the one shared, committed, authoritative pin every checkout reads the same copy of. Only baseline.json (the mutable cache, authoritative solely for a root expected.json does not pin) now lives per checkout; an unpinned root's bootstrap is no longer shared across lanes, the correct side to be wrong on. Also closes the same-checkout half of the race run_austenite's own doc comment already flagged but did not finish: ledger_json_path was keyed by root name alone while out_dir (three lines above it) was already keyed by RC_SLOT and PID. Both are keyed the same way now. Corrects three stale "oxeweb-techspec has no typst oracle" comments (tests/oracle/mod.rs's corpus() doc comment, tests/oracle.rs's module doc comment, and compare_root's F2 comment): re-checked 2026-09-23 against the installed typst 0.15.1, `typst compile` and `typst query` both run clean through the existing patched mirror, so the order-zip now runs for this root -- see the m1-ledger-order commit's own report for the before/after heading-drift numbers this unblocked. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bi5iALpcJRKNKpw7eQSV64

commit c3fb91f Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

commit eed7910 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrMRDoZybG2efz6WJV8Y73

commit a7e7548 For Typst's regex(): show-regex rules and str.matches/replace/split must find what the regex crate finds. Adds numbered and named captures with byte spans, captures_at/find_at with look-behind context, find_iter and captures_iter with the crate's empty-match rule, split, replace_all and replacen with $n/${name}/$$ expansion; Unicode \d \w \s \b; \p{..}/\P{..} incl. gc!=; nested classes, && -- ~~ and [[:alpha:]]; flags i m s x U, inline, scoped and negated; \A \z \< \> \b{start|end|start-half|end-half}; \x \u \U escapes. ^ and $ are text anchors unless (?m). The recursive AST walk is replaced by a program in the shape of the crate's Thompson NFA, run by a backtracker with a heap stack and an (instruction, position) visited set, as the crate's bounded backtracker is: linear time, no call-stack depth, and the crate's captures where a loop iteration matches nothing. The step and stack budgets go; a search needing more than MAX_VISITED bits is refused with an error instead. tests/regex.rs holds it to three external oracles in tests/regex_oracle: the regex crate's own test suite (716 cases, all agree), Perl over a 151-pattern corpus (every start position, iteration, split, replace), and Perl's Unicode data for ~290k code points, differences accepted only where a UCD 15.0 -> 17.0 file diff lists the change. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bi5iALpcJRKNKpw7eQSV64

commit 44d1a85 compile::font_families now seeds from fonts::embedded_families() -- the font lane's own accessor, landed in this unit -- instead of duplicating the embedded family list; EMBEDDED_FAMILIES and wasm.rs's doc comment are corrected from "Latin Modern Math" to "New Computer Modern Math" to match. tests/wasm_api.rs's fc-scan test now reads the actual embedded file (NewCMMath-Regular.otf, latinmodern-math.otf having been removed by this unit's font swap) and compares family names with same_family rather than a literal match, since the file's own declared name ("NewComputerModern Math") differs from Typst's spelling only in whitespace. tests/pdf_fonts.rs's maths oracle test (from m1-pdf-fonts) likewise checked pdffonts' output for the old font's PostScript name; updated to the new one, or every maths PDF fails the embedding check for a font that no longer exists rather than for anything wrong with the embedding. No pinned oracle root's PDF hash moves: none of the 16 crate-owned fixtures compared above use maths, confirmed by rendering each with this branch's binary and diffing the PDF hash against tests/oracle/ expected.json, which m1-pdf-fonts already re-pinned for font embedding. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bi5iALpcJRKNKpw7eQSV64

commit 158ba79 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

commit 5144af6 compileProject (and compileProjectVector, compileProjectDelta) now return {pages, diagnostics, skipped} beside the artefact instead of dropping the refusal table, so a PDF that passed over a construct no longer reads as a clean success. A project with `strict: true` is refused -- {error} in place of the PDF -- on any skipped site, zero pages, or a source setting no content. Failures are {error, diagnostics, skipped}, the error a `file:line:col: message` line: refusals at their real span, an unreadable cited file (a missing #include) at the literal that names it, else 0:0. fontFamilies(project?) lists the embedded families plus each injected `<Family>-<Variant>` font the face resolver loads (one SWITCH-marked call site for the font lane's accessor). engineInfo() gives {engine, version, git}, the commit captured by a new build.rs. The testable core (Report, Diagnostic, locate_error, emit_pdf, font_families, engine_*) lives in compile.rs; tests/wasm_api.rs checks it against pdfinfo, fc-scan and git. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bi5iALpcJRKNKpw7eQSV64

fe2o3_austenite: update the oracle self-test's hardcoded styling-fixture hash

fe2o3_austenite: re-pin oracle PDF baselines for embedded subset fonts

Merge unit/F1F2: fe2o3_geom viewport, Web Mercator, clipped rings, cell cover, world file

Merge unit/P1A: fe2o3_net lean WsClient, read_frame, and handshake checks that count

fe2o3_austenite: render-level list-fidelity gate

fe2o3_steel: admission control, token-gated health body, distress watcher

fe2o3_net: per-IP concurrency cap, guard eviction and decay, bounded TLS

fe2o3_core: add ct_eq for constant-time byte comparison

austenite: render styled-box content instead of silently dropping it

austenite: expand inline mid-prose content-fn calls

austenite: strong #pagebreak adds a trailing page; substitute a standalone-line scalar

austenite: resolve term-dict keys after parameter substitution in content-fn bodies

Merge builtin render-fix: own-line #pagebreak/#v beneath prose are honoured

Merge native Pearlite reader (winit+softbuffer gui, PageSink refactor)

austenite: substitute scalar #let value bindings

austenite: markup builtins own-line only; refuse trailing/mid-prose and ignored args

pearlite+ore: harden the collaboration signing core against a malicious peer

austenite: evaluate #let content bindings and resolve #import on all paths

fe2o3_net: std-only loopback static server + optional async/TLS; drop python http.server

austenite: wire the incremental memo into compileProjectDelta (the swap payoff)

austenite: Austenite-wasm changed-only page delta (wasm swap increment)

austenite: set a main index reference's folio in bold (idx-main)

austenite: set a main index reference's folio in bold (idx-main)

austenite: prove the memo is byte-correct under a pagination-shifting warm edit

austenite: incremental content-hash memo (A7 increment 1 — block + page memo, native)

pearlite: collaboration backend — format-v1 doc_id + Ore signed-op sync + o3db hub + fold (increment 1)

austenite: set index entries by display text, italic markup and a folio comma

austenite: convert -- to en dash and --- to em dash in markup (Typst smartypants)

austenite: render #cite and gather #index/#claim inside table cells (silent-loss fix)

austenite: bound skip-scanner // to line end + Frame::Raw for backtick spans (G6)

austenite: milestone-audit fixes for the back-matter units

austenite: flow_columns foot guard, columns loud refusal, index x-band gate

austenite: fix stale media-bracket-fixture comment

pearlite: native .prl reader crate -- raster + loopback browser-shell app (Phases 1-2)

austenite: generic multi-column body flow; index renders two-column

austenite: web reader honours leaf colour, .prl gated against real SVG output

austenite: replace ? with house error macros in the construct-handling helpers

austenite: rebase include-fix onto main, re-pin techspec for sec_dilemma, tag include-refusal file

austenite: flow breakable glossary rows across pages; bibliography at 0.85em; add glossary oracle root

Merge dilithium mode-gate: a no-mode fe2o3_crypto build compiles

austenite: complete anchor-region membership for float relayout (nested anchors)

gitignore: exclude .wt worktrees, so a git add or ore mark never captures a checkout

Merge P-256 verify: wasm-clean verify-only ECDSA behind the p256 feature

austenite: generate the glossary and index back matter

austenite: key the oracle render dir by RC_SLOT and PID to stop lane races

austenite: honour em paragraph spacing in the #set par lowering path

austenite: lift the shared compile pipeline into one module

austenite: upgrade float_fixture to a true Typst-parity gate

Merge fe2o3_geom::cell: cube-sphere quadtree global grid (H3 replacement)

austenite: Pearl v1 -- a self-describing text-leaf tail, root-fixing the v0 split-brain

Merge wt-wasm (D1): Austenite wasm target via in-memory VFS

austenite: #sub[...] subscript, and evaluate table row-remap .map() spreads

austenite: render #strong[...] and #strong("...") as bold

austenite: #let furniture milestone 2 -- #aside-box, palette, stroke, spacing

austenite: #let furniture milestone 2 -- #aside-box, palette, stroke, spacing

austenite: general #let template-function expansion (milestone 1: #pr-note)

austenite: general #let template-function expansion (milestone 1: #pr-note)

austenite: consume a template's block.with(inset:, radius:) instead of dropping them

austenite: A1 MARGINALIA -- outside-margin claim codes drawn post-convergence

austenite: A1 MARGINALIA -- outside-margin claim codes drawn post-convergence

austenite: thread a prose text fill colour through the engine

austenite: resolve block-scoped heading faces on the lone-file path (A1 finding 4)

austenite: Transform::Template -- template-with-holes + wrap show rules (A1 Part 2)

austenite: Transform::Template -- template-with-holes + wrap show rules (A1 Part 2)

austenite: scope-transparent keep-with-next for a par rule (A1 finding 5)

austenite: scope-transparent keep-with-next for a par rule (A1 finding 5)

austenite: stop the reader double-reporting an authored show rule (A1 finding 3)

oracle: re-pin oxeweb roots after source drift

oracle: re-pin oxeweb roots after source drift

austenite: thread keep-with-next through a nested scope edge (A1 finding 1)

austenite: a heading text-size rule resizes the heading (A1 finding 1)

austenite: styling rule engine -- selector + set-fields transform (A1 Part 1)

austenite: make the document-order walks scope-aware (A1 Part 0)

austenite: align group_dat read-set with the renderer (A1 concern 4)

austenite: align group_dat read-set with the renderer (A1 concern 4)

austenite: face resolver reaches every face a rule could name (A1 concern 3)

austenite: no #set silently no-ops -- consume or refuse (A1 concern 2)

austenite: nesting-aware scopes with a proven Block::Scoped (A1 concern 1)

austenite: green the oracle gate -- drop austenite-doc for now, make expected.json authoritative

austenite: green the oracle gate -- drop austenite-doc for now, make expected.json authoritative

austenite: pin the oracle reference in-tree so a fresh box cannot self-bless a regression

austenite: make the renderer consume the theme's heading face -- resolve and set it (toward Typst)

austenite: reshape the Theme for the rule engine -- Vec levels, an opener group, page classes, group_dat

austenite: refuse a #set that lowers to nothing rather than drop it silently (H2)

austenite: scope a subtree's #set to that subtree via theme-scope markers (H1)

austenite: introduce ThemePatch and lower declarations to a patch, not a mutated Theme

austenite: harden the oracle harness -- assert PDF hash, oxeweb-vs-Typst, styling fixture, raster

austenite: harden the oracle harness -- assert PDF hash, oxeweb-vs-Typst, styling fixture, raster

austenite: lower a document's #show: doc.with and top-level #set onto the Theme

austenite: lower a document's #show: doc.with and top-level #set onto the Theme

austenite: replace the flat Style struct with a grouped, serialisable Theme

austenite: upgrade the reader's skip tally into a per-site refusal diagnostic

austenite: upgrade the reader's skip tally into a per-site refusal diagnostic

austenite: add an oracle harness that reproduces Typst against a bounded corpus

austenite: add the maths symbols and layouts the TechSpec uses -- circled ops, blackboard sets, ceil/floor, binom, display

austenite: add the maths symbols and layouts the TechSpec uses -- circled ops, blackboard sets, ceil/floor, binom, display

austenite: make the bracket scanner content-mode aware so captions with prose parens close

austenite: keep an open display-maths block from being stolen line by line

austenite: keep an open display-maths block from being stolen line by line

graphics/austenite: store glyphs as Type-3 fonts with a ToUnicode CMap

graphics/austenite: store glyphs as Type-3 fonts with a ToUnicode CMap

graphics/austenite: compress PDF content streams and round coordinates

austenite: wrap the doc title page's title to the rail width

austenite: wrap the doc title page's title to the rail width

austenite: nest indented sub-lists so a numbered flow keeps counting

austenite: render #styled-box[...] callouts instead of dropping the body

austenite: render #print-glossary() as a Term/Definition table

Merge lane/pearl-v0: Pearl (.prl) format, Rust + web readers, annotations

Pearl web reader: in-browser annotation authoring

Pearl web reader: open-your-own-file, clickable links, rendered annotations

Merge lane/pearl-annots: links + annotation anchor model in Pearl

austenite: Pearl web reader parses the real .prl in the browser

austenite: Pearl web reader first cut + pearl_json transport

ore: exercise forget against a move, a cross-boundary cut and an overlap

austenite: a Pearl v0 keystone -- one document round-tripping to SVG parity

jdat: say which way min_size_int narrows, and pin its boundaries

Grow a stalled sketch, and tell a carrier where it left off

ore: let a peer be told what to write where a forgotten operation stood

ore: let an operation be forgotten, keeping its shape and losing its content

text: name the files a secret lives in, beside the scanner that reads its shape

sbj: a share may not carry armed automation or the sender's own machine

o3db: close the residual GC read races -- pin postgc reads, retry with a fresh location

o3db: invalidate reader file handles on GC rename, and always release the reader count

o3db: online orphan sweep, and fix a latent deleted-chunked-value read

jdat: bound the BDAT streaming loader against a torn or hostile length

o3db: live-set migration tool to compact a store and drop orphaned chunks

o3db: reclaim superseded chunks via deterministic keys, fix chunk-record GC accounting

o3db: durability barriers on seal and GC, torn-tail-tolerant rebuild, group-commit default

net: add vision (image) support to the OpenAI-compatible llm client

austenite: an explicit #section-banner owns its chapter's header in a DocBanner doc

austenite: colophon says Austenite, not Typst

austenite: fix stray folio and footer logo on inline-idiom front matter

austenite: render the doc META/colophon page

Merge branch 'lane/austenite-sectionbanner'

austenite: emit a PDF document outline, front matter first

austenite: render the doc template's two-column title page, section logos and footer logo

Merge branch 'lane/austenite-citegroup'

Restore fe2o3_graphics test harness against current types

Fix i32 overflow in maths delimiter target for tall matrices

Merge branch 'lane/austenite-diagrams'

austenite: resolve citations when compiling a lone chapter

graphics/austenite: shape SVG <text> labels and decode embedded <image> rasters

austenite: unnumbered banner headings and skip reporting for doc trees

austenite: a --watch recompile mode

austenite: rename the compiler binary to austenite

austenite: read #link, term-dict glossary aliases, columns, and report skips

austenite: render bold-italic emphasis and honour table align closures

austenite: default the emit window to eight pages for speed

austenite: render standalone #line() horizontal rules

austenite: close small-scale fidelity gaps with the Typst oracle

austenite: render SVG figures as native vectors

fe2o3_graphics: a targeted SVG document reader

austenite: colspan-aware table cells, set ragged

austenite: full-bleed cover and a Part N label on divider pages

austenite: equation cross-references

austenite: number display equations

austenite: cross-references resolve to Figure/Table/Chapter N

austenite: render heading titles in running heads and the TOC

austenite: build tables from data-array spreads of any width

austenite: rich table cells and figure captions

austenite: table cell background fills

austenite: parse #emph and #super inline calls

austenite: render claim-label and claim-refs markers as invisible

austenite: rich heading titles so glossary calls render in headings and the TOC

austenite: fix glossary and index calls leaking inside emphasis runs

austenite: resolve citations and emit the bibliography

austenite: generate the table of contents

austenite: title page and front matter

austenite: render real raster images in figures, not a placeholder box

austenite: heading font, chapter numbering and small caps

austenite: verso/recto running heads

austenite: first-line paragraph indent from config

austenite: stream the PDF to a file, emitting each page and dropping its frame

graphics: a page-at-a-time PDF writer that never holds the whole document

austenite: render figures, tables and footnotes

austenite: a BibTeX reader and author-year citation formatting

austenite: render inline glossary and index terms; strip Typst comments

austenite: skip multi-line template calls and code blocks

austenite: a function-plotting module, plots as first-class figures

austenite: parse Typst maths, $...$ into the engine's Atom tree

austenite: inline code and fenced code blocks (Typst raw)

austenite: read Typst markup, not a bespoke language

austenite: a ./dev live-preview pipeline for Ingot documents

austenite: cross-references in the Ingot language (#ref, #total-pages)

austenite: bullet and numbered lists in the Ingot language

austenite: inline emphasis in the Ingot language (*strong*, /emph/)

jdat: decode a user-kind molecular payload as a plain-map value

austenite: tune maths layout to Latin Modern Math's own metrics

austenite: grown radical and delimiters from the OpenType MATH table

austenite: set documents in Libertinus Serif against Latin Modern Math

Resolve a nested user-kind list payload symmetrically with maps

austenite: set mathematics in Latin Modern Math, with per-glyph metrics

Keep a nested user-kind value's molecular payload on text decode

austenite: diagram sub-language -- nodes, routed edges, a typeset flowchart

austenite: Ingot front-end language, real maths font, and a figure seam

fe2o3_net: WebAuthn assertion verification, ES256/EdDSA

Austenite Phase 5: mathematics layout

Austenite Phase 4: footnotes

Austenite Phase 4: tables

Fix the PDF xref test to search raw bytes, not a lossy string

Austenite Phase 6: PDF output, and a PDF writer in fe2o3_graphics

Austenite Phase 3: a table of contents through the ledger

Austenite Phase 2: a document of headings and paragraphs, with furniture

Austenite: render a forward reference's resolved value

Austenite Phase 1: Liang hyphenation as flagged discretionaries

Austenite Phase 1: Knuth-Plass line breaking and justification

Trim the retrofitted documentation off Austenite and fe2o3_font

Austenite Phase 1: shape real text and draw it as glyph outlines

Add fe2o3_font, the shaping and outline layer extracted from Kiln

Add fe2o3_austenite, the Austenite Phase 0 typesetting spine

Add generic 2-D bar-joint rigidity analysis to fe2o3_geom

Reset a nested map value's kind under a non-map user kind

Guard the five-element Op::Settled shape with a test

Document that adding a field to any op is a breaking format change

Add a sans-io RFC 5322 message parse and build to fe2o3_mail

steel: add an optional {file?:path} config reference

A diff worth storing has to say what it was computed against

Let a proposal's author state it again, without touching what they first wrote

Say what damage at the tail of a store actually costs, because it is not what was assumed

Gate the raw insert and get_data WebSocket commands on an operator session

Gate the terminal management commands on an operator session too

Gate the terminal WebSocket route on config and an operator session

Remove a server config knob that nothing has ever read

Let one watched machine say it cannot hold a certificate

Give the publish store's tests the field the record grew

Answer how long an encoding will be without performing it

Read a DER key by its own declared length, and find one that is not at the front

Finish the curve list, and say where every byte actually came from

Catch a private key that has no text shape, by the bytes DER puts in front of one

Let a reader take a record's digest on trust, and say what that costs

`ore import` puts this repository under Ore, and every capturing verb after it walks the working tree. The tree carries 52 GB of `target/`, and Ore reads `.oreignore` rather than `.gitignore`, so without this file the first verb after the import would ingest all of it into a log that cannot forget. The rules are `.gitignore`'s, verbatim, because they are already right: proved against a mirror of this repository's real path set, where Ore's engine and `git ls-files --others --exclude-standard` agree on 1,712 paths with no difference in either direction. `/target/` prunes at the directory entry rather than testing what is under it. Three lines are added that `.gitignore` does not need. Ore reads only the root ignore file, so `fe2o3_namex/.gitignore` has no effect and the 24 kB of `namex_echo` output it hides is named here instead; and `target/`, unanchored and directory-only, catches a build directory under a subcrate that root-anchored `/target/` would let through. `/.ore/` goes into `.gitignore` for the other direction: the store, its bookkeeping and the git mirror it writes all live in that directory, several sessions share this tree, and none of it belongs in git.

written by Jason Hoogland <hoogland@gmail.com>

`ContentTypeValue`'s Display wrote the multipart SUBTYPE and not the type: `multipart/form-data; boundary=X` came back out of the parser as `form-data; boundary=X`. Steel puts that byte-for-byte on the wire to its upstream, whose own parser then refuses it -- "Invalid Media type 'form-data', '/' character not found" -- and drops the connection without writing a response. Seen six times on the live Oregami forge, and the access log records each one as `200 (0 body bytes)` because a status that was never written reads as zero and is normalised to 200. The header carried a second fault on the same line. The whole value was lowercased before parsing, so `boundary=----WebKitFormBoundaryAbC` reached the upstream as `----webkitformboundaryabc`. A multipart boundary is case sensitive (RFC 2046 s5.1.1), so every real upload through the proxy would have arrived with a delimiter matching nothing in its own body -- a fault the render bug was hiding, since nothing got that far. The media type and the parameter name are still matched case insensitively; only the parameter value keeps what was sent. `test_a_multipart_content_type_survives_a_hop_00` asserts both properties over `build_proxy_request_head` and then re-parses what the hop wrote, which is the failure as the forge met it. Each assertion was proved red against its own defect and green against the other.

written by Jason Hoogland <hoogland@gmail.com>

A segment's records are written plainly, and compressing them is worth about 39 MB of 63 on a real history. The saving is redundancy BETWEEN records, and a record is about 1.4 kB, which is too small a window to see any of it: deflating each record alone reached 58.8% where deflating runs of a megabyte reached 38.4%. So one packed record carries a run, each run inflatable on its own, and reaching a record costs its own megabyte rather than the whole segment. KIND_PACKED is a kind and not a header field, on the veil's precedent and for the reason the veil's own doc gives: the kind byte says what was done in the record where it is, rather than in a header that would condemn every plain record beside it. A header field could not have been free anyway, since entries begin immediately after the header and a new field would make an old reader parse it as the start of an entry. So segment::VERSION does not move, VERSION_MIN stays at 2, both segment golden tests freeze the same bytes they always did, and a segment holds packed and plain records side by side. What goes under the compressor is the framing those records would have had written plainly, digests included. So a packed segment yields the same records with the same digests in the same order as the plain one it was made from, which is what keeps a fold over those digests -- the thing a repack compares two stores by -- identical on both sides, and it is what makes packing revocable rather than a door. The run's own digest covers the compressed bytes and is checked before a byte is inflated; it is not tallied, because what a fold names is records. An inflate is bounded by PACKED_MAX, since a compressed frame is an instruction to allocate and it arrives from wherever the segment did. deflate through flate2, which resolves to miniz_oxide: pure Rust, and it builds for wasm32 like the rest of this crate, where zstd binds C. At the megabyte frames this format uses zstd's advantage is 2.9 points rather than the 4.5 it shows over a whole segment, because a frame that size neutralises most of its long range matching. The level is not recorded and no golden test freezes a packed payload: what a compressor made of the records is not a fact about Ore, and freezing it would freeze a dependency version and call it a format. The registry's five open rows are closed, and they move rather than vanish: a `settled` section records the answer and keeps guarding the spellings the answer ruled out, so the second lane to arrive cannot build the alternative that was considered and rejected without a test saying it was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

The version constants, wire codes, kind bytes and golden-byte tests were written down in a design document, which named snapshot::VERSION at a line in a file that had been deleted four days earlier and listed a golden test that had gone with it. Nobody noticed until somebody was asked to look. format.jdat carries the same facts as data, beside the code they describe, and tests/format_registry.rs asks the tree whether each is still true: that a constant is declared where the registry says and holds the value it declares, that every public constant in a format bearing file is registered or exempted, that the registry names every golden test and no others, that a frozen array still stamps the constants it pins, that the version table says what highest_code says and covers every version from VERSION_MIN upward, that a name recorded as removed is gone, and that no name still recorded as open has been invented. The last of those is what a lane reporting a seam has lacked. A question the owner has not answered guards the spellings whose appearance would mean somebody answered it in passing, so inventing one fails a test rather than waiting to be read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

The author trailer's spelling went upstream so a mirror and a forge could not drift about what a mark says, and then the interesting half of the rule stayed downstream in two copies: `mirror::split_moment`, which wants the offset, and `forge::named_in`, which wants the name. They agree because they were written to agree, which is the arrangement the move was made to end. It goes in `fastexport` rather than beside `AUTHOR_TRAILER` in `op`, and that is not a preference. The clean signature returns a `When`, `fastexport` already imports `op::Mode`, and `op` importing `fastexport` back would be a module cycle -- so `op` would need a second moment type of its own, duplicating `TzOffset` to avoid a cycle, to hold a value whose format is git's. The format is `fastexport`'s subject and `When`, `TzOffset` and `Person` are already there. `AUTHOR_TRAILER` now points at it, and the sentence saying a caller splits the tail itself is withdrawn. `parse_when` does the deciding, being the one reader of git's raw date format here, so the all-or-nothing rule is not restated: its refusal is what "there is no moment on the end of this" looks like. The forge's guarded cases come with it as a doctest, `J H <j@h.test>` among them -- a line that splits on spaces perfectly well and would come back as `J` under a rule that only counted fields. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

A gateway with a 2.6 GB store could not start at all. Database initialisation completed, activate_gc sent GcControl to the zone bots, and neither answered within the six seconds of USER_REQUEST_WAIT because both were still surveying the store's files. Measured after this change: survey to listening takes about eight seconds. It was dying at six. The deadline was the defect, not the store and not the caller. A user request is given a short deadline SO THAT a slow request path is a visible error rather than a hang; a control operation runs once, has no client blocked on it, and its failure is total. Waiting is nearly free there and failing is expensive, which is the reverse of a user request, so CONTROL_REQUEST_TIMEOUT is five minutes -- bounded rather than unbounded, because a bot that is genuinely dead must eventually be reported instead of waited out for ever. Raising USER_REQUEST_TIMEOUT instead would have loosened every user request to hide a startup problem, and the comment at the constant says so. `scan` keeps its six seconds and gains `scan_with_wait`. The short deadline is what makes "nothing on a request path may walk the store" enforceable rather than advisory, so it stays the default and a deliberate background walk names its own -- visible at the call site instead of buried in a shared constant. get_zone_dirs deliberately keeps the short one: it reports state the bots already hold, and a five-minute hang on an inspection call would be a new defect. The ordering the constants have always needed is now checked rather than commented. "User timeouts must last longer than internal bot timeouts to avoid lockups" was true and unenforced; O3db::new refuses a configuration that breaks it. AND THE FAILURE IS LOUD. The old error was accurate and useless -- "Expecting 2 messages via responder, received 0 when timed out after 6s" -- naming the count and the deadline and nothing about what was attempted or what to do. It cost four wrong diagnoses over two hours before anyone read the gateway's log. Both seams now name the operation, the likely cause, the governing constant, AND the wrong fix as wrong. No signature moved, so no call site needed changing -- confirmed by a grep of the whole of ~/usr/code rather than the crates in hand, which turned up three consumers nobody had named: powls, Oregami, and eleven sites in Ochre. A peer session took a live service down for hours yesterday by adding an argument to a shared function and checking one of its two consumers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EaQ7hg4AkqViSRZhasMB9A

written by Jason Hoogland <hoogland@gmail.com>

The importer writes git's whole author line into the trailer -- `Name <email> 1735089438 +0800` -- because `Op::Mark` holds a time in UTC and no zone, so the offset an author's own clock was reading survives an import only here. The doc described the value as the identity line and the example showed one without a moment, which understates it in the direction that bites: a forge reading the trailer to show a person a name, and printing the value whole, prints a timestamp in the middle of it. Neither function looks at the shape, so nothing behavioural moves. This is the description catching up with the caller. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

The crate root still listed `snapshot` among its modules, which is an unresolved intra-doc link since the format went in 2e956a4, and RepoNote's note still derived its file views from a snapshot rather than a render. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

`ore import` records each git commit's original author line as an `Ore-Author: ` trailer on the mark it becomes, so that the mirror can write the commit back under the name it was written under. Three programs have to agree about that line: the importer writes it, the mirror reads it back, and a forge reads it to show a person the name rather than the bookkeeping. Two of them are in `ore_cli`, which is a binary crate with nothing to depend on, so the third had no way to reach the constant and would have spelled it a second time. This is where `AUTO_MARK_PREFIX` already lives and for the same reason, so `AUTHOR_TRAILER`, `with_author` and `without_author` join it beside `Op::Mark`. Nothing here is a new rule: `without_author` is `ore_cli::mirror`'s own, taking `&[u8]` rather than allocating, and `ore_cli` should now delete its copies and call these. Nothing existing changed, so nothing that compiled stops. The rule worth having in one place is **exactly one line comes off, and never a loop**. A git commit message may itself end in a line beginning `Ore-Author:`, and the import writes its own after it; a reader that stripped until no trailer remained would author the commit under the name in the *person's* line and delete that line as it went. The doctest carries that case, and against a looping version it fails on it -- proved before the wording was written. What the split cannot decide is written down beside it: a mark authored in Ore whose body's last line a person typed as `Ore-Author: ...` is indistinguishable from an imported one. Nothing in a mark says whether it was imported, and adding something would be a discriminator in the history for one importer's benefit. 341 tests and 3 doctests in fe2o3_ore. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

A segment reader computes a digest over every record to check it and then drops it, so a caller wanting to name the exact bytes it read had to hash the whole segment again: 205 ms over a 55 MB segment, against 7 ms of folding digests already paid for. `Reader::tallying` keeps them and `Reader::take_digests` drains them, so a caller working a batch at a time never holds more than a batch of them. Nothing about the format moves. The digests are the ones already written and already compared; only the dropping of them changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

`check_refname` exists to answer whether git will accept a name, and it said yes to three that git refuses. Naming a mark after a commit's subject gave fe2o3's import mark names of 259, 297 and 312 characters; a loose reference is a file named after the component and a file name is 255 bytes, so `git fast-import` applied the whole stream and then refused it over the refs it could not create -- on stderr, after the caller's command had already returned successfully. Bytes and not characters, and the difference is the point: 200 accented letters are 200 characters and 400 bytes in the directory entry. Each component is asked separately, since the limit is on the file name and not on the path, so a long name may hold two long components and no illegal one. Git states no such rule, which is why the function's doc now says where this one comes from instead of resting on `git-check-ref-format(1)`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

A credential written into a source file is stopped today by a global git pre-commit hook, which is a hook and therefore covers git and nothing else. A tool that writes history another way has no such protection, and its shapes, its placeholder excuses and its `allowlist secret` marker have to be the same ones or a fixture marked for one tool is refused by the other. So the hook's two classes move into the library, over bytes rather than str, since a source file carrying one invalid UTF-8 byte is exactly where an unnoticed key would sit. The shapes are matched by hand rather than through the regex engine: each is a literal opening and a run of one character class, which one pass along the line decides, at about 190 MB/s over real source. Checked against the hook itself over a corpus holding every class, every placeholder and every spelling of the marker: the two agree finding for finding. The module also holds the PEM header in two halves, so that a scanner reading this file finds no header in it -- which the hook established by refusing the first draft of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M7yKwfzCJVYoi6FVKcvQKf

written by Jason Hoogland <hoogland@gmail.com>

A second pass over the same diff. The property test's doc gave a paragraph to each of its three shape families where a clause each was owed, the skipped counter test explained Lamport minting twice over, and `is_indexed` described what the index is instead of what the accessor answers. fe2o3_ore's added documentation goes 304 per kloc to 200 across the two passes, against 44 the author writes. What remains is mostly the reason a test exists and what it would catch, which is the convention this crate already keeps and the thing the red-then-green discipline rests on. 334 lib tests green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

rc-4 measured the documentation this lane added and it is the worst in the library: 156 doc lines against 514 of code across `49d3b67..HEAD`, 304 per kloc, where the author writes 44 and where the sweep that ran three days ago was built to remove a rate of 170. The crate as a whole reads low, because 27 swept files mask 514 new lines, which is why the diff is the unit and not the crate. One of them was a flat rule violation rather than a matter of taste: `VECTORS_ENTRIES_MAX` carried a nine line `///` block, and a constant takes an aligned trailing note. The rest were essays where a sentence was owed. The version vector's own doc kept the fact a reader could not derive, that a column is a run because a replica forks against itself twenty-nine times in the measured history, and lost the derivation around it. `build`, `fill`, `is_graded`, `index_runs` and the two comments inside `reaches` all say the same things in about half the room. Nothing was moved from `///` to `//` to flatter the measurement. The house rule already prefers the words inside the function, and the inline comments came down with the rest. 334 lib tests green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

A snapshot was a materialised copy of the whole working tree, written beside the log so that a reader could see the present without replaying the history. It was worth having when replaying cost fifteen seconds. It is not worth having now. Measured on a 44,629 operation history, against the tool with the snapshots removed: a current one saved about two tenths of a second and held 67 MB of memory to do it, on top of 31.8 MB of disk. It was also unusable for almost every command, because the frontier moves the moment anything is appended and the next was written only after the log had grown by half a tree, which on that project is about ten days. So ORESNP goes, and with it `Rendered::from_parts` and `Repo::from_states`, which existed to rebuild a repository from a snapshot's flattened states and had no other caller. `a_mode_rides_the_snapshot` goes too: it existed to show a file mode surviving the round trip, and there is no round trip. Nothing is lost that was not derived. The asymmetry the module's own header stated still holds, and it is why this deletion is safe where deleting a segment would not be: nothing is lost by discarding a snapshot, and everything is lost by discarding a segment. 334 lib tests, down from 352 with the format's own suite gone, and the tool's 35 targets stay green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

`Causality::reaches` was the engine's hottest function by a wide margin. Bounding its walk by counter took the render from 14.8 s to 4.9 s on a 44,629 operation history, and left roughly 4.5 s of that still walking, because the bound only narrows the window and a genuinely concurrent pair sits inside it. `Causality::new` now builds a version vector per operation and `reaches` reads the answer out of it. The render on the same history goes from 5.4 s to 0.26 s. The obvious index keys a column per replica, and it is refused on the very history it was written for. A replica does not always name its own previous operation: an imported history takes its parents from the shape it was imported from, and this fixture forks a replica against itself in 29 places. So the build cuts a replica at each fork and gives every unbroken piece a column of its own. Within a piece, each operation has the one before it in its ancestry by construction, which is exactly the property the lookup needs. Two replicas over this history become 31 runs and 12.4 MB. The index is refused, and the walk kept, wherever it cannot be trusted: an ungraded graph, a parent the graph does not hold, a chain check that fails after the cut, or a matrix past the 32 MiB ceiling. `reaches` gives the same answer either way, always, which is the whole contract. A counter nobody spent is the trap. Lamport minting leaves gaps in a replica's counters, so an identifier the graph does not hold can sit below the vector's value for its run, and the lookup has to refuse it by asking whether the operation exists rather than by comparing numbers. A history whose counters happened to be consecutive would never show it. Proved against six deliberate breaks, each restored: never cutting a fork, cutting only every other one, dropping the absent-target guard, dropping the missing-parent check, dropping the grading gate, and never building the index. Each reddens with a message naming the pair that disagreed or the shape that was wrongly admitted. The property test now covers three shape families and asserts it saw all three. 352 lib tests, and the 36 targets of the tool, stay green. Cross-checked outside the test suite as well, on the real history rather than a generated one: 4,000 pairs against an exhaustive walk, 1,985 of them reachable, no disagreements. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

The name was built by a `format!` in the tool, read back by an extension test in the store, and reconstructed a third time by string surgery in a test -- three spellings of one rule, and no reader that could turn a name back into the operation it names. A reader that cannot do that cannot order the files it finds, which is why `snapshot_at_frontier` was taking whichever snapshot the directory happened to yield last. `file_name` and `named_at` are a pair, upstream where the format is, for the reason `AUTO_MARK_PREFIX` moved upstream: two crates apply the rule. The substitution they exist for is the colon -- an identifier is spelled `r<replica>:<counter>` and that is not a filename everywhere. `named_at` refuses anything it did not write, which is how a torn write, an editor's backup and a foreign file are skipped by one test rather than by a rule each reader keeps for itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

The render checked conservation only under a debug build, so a caller wanting the check in release called `check_conservation` -- which rebuilt the atoms, the tombstones, the overlap arbitration and a whole trial layout to ask a question the render had just had the answer to. Both callers in Ore did exactly that. Measured on a 44,629 operation history: 5.51 s of a 20.2 s open, for an answer already available. Checked in place it costs 1.3 s, and once the ancestry walk was bounded it costs 0.13 s. So the check now runs in every build, at the end of `render_with`, against the atoms and tombstones that render used. `check_conservation` stays for what its name suggests -- a repository assembled some other way, or one a test has damaged on purpose -- and says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

`Causality::reaches` walked the entire parent graph, with no bound and no memory, once per question. A `false` answer had to exhaust the ancestor set to be sure of itself, and `concurrent` asks for two of them -- so the pair the repository exists to handle, two genuinely concurrent edits, was the pair that cost the most. Measured on a 44,629 operation history: 12,128 calls popped 187 million nodes, and three stages of the render -- `yields`, `stranded` and `overlaps` -- spent 98% of their time in this one function. Nothing else in the render was near a bottleneck. An operation takes the counter one past the highest the log holds, so every parent edge steps strictly downwards. Nothing at or below the target's counter can reach it, and a branch that has fallen below it can only fall further. The walk is then bounded by the counters between the two operations instead of by the size of the history. That rule is NOT enforced. `OpLog::append` requires a parent to be present and a replica's own counters to rise, and neither forbids a hand-assembled graph whose child sits at or below its parent -- `an_operation_before_its_parent_is_refused` builds exactly such a pair. So `Causality::new` measures the property in one pass over the edges and `reaches` asks before it leans on it; an ungraded graph is walked as it always was. The new test builds both kinds and compares every pair against an exhaustive walk kept beside it as the definition. It was proved against the unconditional bound first, which it catches on its first ungraded shape. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FD47XinXuf9CiXPT8QK5AP

written by Jason Hoogland <hoogland@gmail.com>

`Rendered::from_parts` and `Repo::from_states` take what a snapshot holds and present it as a render, for a reader that wants to see the state rather than merge into it. `Snapshot::into_files` hands the states over instead of lending them, because a snapshot of a large tree is most of a working copy and copying it to read it doubles the largest thing in memory at the moment it is least affordable. A repository built this way carries no placement index, no repository-level notes and no deleted files, because a snapshot holds none of them. Said in the doc comment, since a caller needing any of those must render. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBLKZZGp2dDYcL27BWdCBL

written by Jason Hoogland <hoogland@gmail.com>

`Sequence::layout` wants one thing: which file each slot ended up in. It was getting that by rendering the entire working tree into `BTreeMap<OpId, (Vec<u8>, Vec<Run>)>`, keeping `owner`, and dropping every byte it had just written. A whole copy of the tree computed and never read -- and it happened twice on every repository open, once under `render_with` and once under `check_conservation`, both of which reach `layout` through `birth_files`. `traverse` now takes an `Emit`. `Emit::Bytes` is the render and is unchanged. `Emit::OwnersOnly` walks the same forest, in the same order, and fills `owner`, `orphans`, `orphaned` and `max_depth` exactly as before, while allocating nothing for content. The orphan tally is deliberately on the common path: it is a fact about ownership, which is what the cheap walk is for. MEASURED on a real 44,628-operation history, release, three runs each: before 263,136 kB 5.79 kB/operation after 244,064 kB 5.36 kB/operation 19.1 MB, 7.4% less The figure was found the cheap way first, and that is worth recording as method: disabling `check_conservation` outright removed one of the two discarded renders and took the peak to 243,380 kB. That said the cost was real and where it was, in twenty minutes, before a line of the actual fix was written. This change gets the same saving and KEEPS the conservation check, which was never the problem -- the waste was in what `layout` asked for, not in what the check does with it. Attribution by reading finds where bytes are; only a measurement finds WHEN. An envelope-payload change tried the same day looked better on paper -- the signed bytes are held twice and that is 41% of the total -- and made the peak 2.3 MB WORSE, because the two copies do not coexist at the maximum. It was reverted and written up in the audit note. Still above the 5 kB per operation budget, which stays missed. 345 engine tests, the whole ore workspace, and the render output unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBLKZZGp2dDYcL27BWdCBL

written by Jason Hoogland <hoogland@gmail.com>

`CalClock::to_nanos` added the whole nanosecond-of-second field to a millisecond figure that already carried the whole-millisecond part of it, so the result overcounted by up to 999 ms and RAN BACKWARDS at every second boundary. Ordering is built on that number, so `is_before`, `is_after` and every comparison derived from them answered wrongly across a second. Only the sub-millisecond remainder was ever missing, and zone offsets are whole milliseconds, so nothing below a millisecond is lost on the way in. Two more found while fixing it, both in the inverse: - `from_millis` divided with truncation, so a pre-epoch instant landed on the day ABOVE it with a negative millisecond-of-day, which then wrapped when cast to u32. 1969-12-31T23:59:59.999Z was the whole of 1970-01-01 at an enormous offset. Euclidean division floors instead. - `from_nanos` REPLACED the sub-second field that `from_millis` had just set rather than adding to it, throwing the millisecond part away and breaking the round trip with `to_nanos` for any instant with milliseconds in it. Both new tests were proved against the broken code before the fix landed: the monotonic one steps across a second boundary and fails naming the direction, the known-value one is checked against a day count derived by hand rather than against the function's own output. Comment corrections in `fe2o3_ore`, no code touched. Two carried bad arithmetic of mine: 344 bytes an operation is 4% of the memory ABOVE the binary's floor and was written as though the rest were all content, when it also holds envelope payloads, a segment read whole and BTreeMap nodes that split badly under ascending keys; and `Atoms::total` was said to over-report "by up to three", when what it actually reports is bytes an atom can be read for rather than bytes this map keeps alive -- a different quantity, not the same one scaled. NOT FIXED, and pre-existing: nine failures in `fe2o3_datime`'s calendar tests. Established as pre-existing by running the suite with these files reverted -- 245 passed, 9 failed, identical both ways. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBLKZZGp2dDYcL27BWdCBL

written by Jason Hoogland <hoogland@gmail.com>

GitHub reported 12 vulnerabilities on the default branch, 1 high. Dependabot counts every unmaintained-crate notice as a vulnerability, so the number overstates: `cargo audit` finds FIVE real ones and 18 advisory notices. The 2026-04-16 triage in memory says not to chase the count, and it is right; what it did not have is the high, which is newer than it. Fixed, by `cargo update` within existing semver bounds: - rustls-webpki 0.103.12 -> 0.103.14 (RUSTSEC-2026-0104). A REACHABLE PANIC in certificate revocation list parsing, published 2026-04-22, after the last triage. This is the one that matters and the reason not to defer the lot: fe2o3_net's TLS is what Steel serves the public web and karri's mail on 25/587/993 with, so a panic reachable from certificate handling is a denial of service on live infrastructure rather than a theoretical one. - ring 0.17.8 -> 0.17.14 (RUSTSEC-2025-0009). AES panic under overflow checking. The earlier triage called it no real risk because release builds disable overflow checks, which is still true; it is taken now because it came free with the others. - crossbeam-channel 0.5.14 -> 0.5.16 (RUSTSEC-2025-0024), double free on Drop. - crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204), invalid pointer dereference in a `fmt::Pointer` impl. Carried along by those: aws-lc-rs 1.16.2 -> 1.18.0 and aws-lc-sys 0.39.1 -> 0.44.0, which is a C build and therefore the part worth checking rather than assuming. `cargo check --workspace` is clean. NOT FIXED, deliberately: time 0.3.37 (RUSTSEC-2026-0009, DoS via stack exhaustion on a crafted parse, 6.8 medium). The fix needs >= 0.3.47, which needs serde >= 1.0.229, which REMOVES `serde::__private` -- and `swc_common` and `swc_config` import that path. swc is a forty-crate tree under fe2o3_steel's JS bundler, so taking this fix means upgrading the whole swc stack underneath the server that runs live mail. That is a refactor with real risk, dressed as a security update, to close an advisory the 2026-04-16 triage already established is not on an attacker path here: fe2o3 parses time with its own fe2o3_datime, and `time` is transitive and reachable from no input a stranger controls. So it waits for a deliberate swc upgrade with its own testing, and this commit records why rather than leaving a future reader to rediscover the conflict. Proved rather than assumed: serde 1.0.229 was taken, the workspace was checked, and swc_common and swc_config failed to compile on `serde::__private`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBLKZZGp2dDYcL27BWdCBL

written by Jason Hoogland <hoogland@gmail.com>

Opening a repository of real size cost 7.63 kB of resident memory PER OPERATION -- 345,272 kB for 44,628 operations, and rising by roughly 1,300 operations a day on the largest history we have. Measured by rc-1, whose finding reframed the whole thing: `ore log` touches no network and costs the same as a clone, so this was never a transport problem. Every verb that opens the repository pays it. The cost is not the structures. `Op` is 112 bytes and `Record` 152, so the fixed per-operation cost across the log, `Applied` and the `Atoms` key is about 344 bytes -- 4% of it. The other 96% is the content of `Op::Splice { insert }`, which was held three times over: once in the log's record, once in the sequence's cloned `Applied`, and once more in `Atoms`. So `insert` is an `Arc<[u8]>`. The bytes exist once and the three structures point at them: `Sequence`'s clone of an operation is now a refcount bump, and `Atoms` holds a handle rather than a copy. Nothing borrows and no lifetime appears anywhere, which is what makes this a wide shallow diff -- the type, its two format sites, and the construction sites -- rather than lifetime parameters threaded through the renderer. MEASURED, on the real 44,628-operation store rather than a fixture: before 345,272 kB 7.63 kB/operation after 263,136 kB 5.79 kB/operation 24% less THE FORMAT DOES NOT MOVE, and that was proved before the construction sites were touched, because if it did move every existing store would be data nobody can open. `Dat::BU64` receives the same byte sequence whatever owns it -- the encoder already copied into the daticle, so there is no new cost there either. Confirmed twice: the golden-byte tests pass unchanged, and the changed binary read an existing 44,628-operation store written by `cb617c9`, reported the same frontier, and left both segment files byte-identical by md5. `Atoms::total` needed its doc rewritten rather than its code. It sums the length of every atom, and those bytes are now shared with the records they came from, so "bytes held" quietly stopped meaning what this structure costs and started meaning what it can see. A caller using it as a memory figure would over-report by however many owners each buffer has -- during a memory optimisation, which is the worst possible moment for a measurement to change meaning under its own name. Caught by rc-4 reading the diff's path, not by me. WHAT THIS DOES NOT DO: it does not reach the 5 kB per operation that rc-1 set as the target, and my prediction that sharing would beat the arithmetic -- fewer allocations, exact sizing over `Vec`'s capacity slack -- was wrong. That is the third confident prediction about this memory today and the third to fail on contact with a measurement. 258 MB per 44,628 operations is still resident with the content held once, and where it lives is now a profiling question and not a reasoning one. No guard is added here, because a guard at 5 kB would be red. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBLKZZGp2dDYcL27BWdCBL

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_file/Cargo.toml has named oxedyne_fe2o3_stds since the office module began reading media labels from it, and the manifest change went in without the lock entry it implies. Left uncommitted the file is a hazard rather than a nuisance: fe2o3 is one shared working tree, so any lane running git add -A sweeps it under an unrelated message, which is how two lanes' work was mislabelled on 17 August.

written by Jason Hoogland <hoogland@gmail.com>

53 tests where there were none that could catch anything: three real breaks -- a STARTTLS downgrade accepting pipelined bytes, dot-stuffing removed, and the login moved after the envelope -- all shipped clean through 296 passing tests before this. is_permanent had never returned true. res! wraps a cause in Error::Upstream with empty tags and Error::tags() reports one frame, so the Permanent tag on a 5xx was invisible one wrapper away. Steel has therefore never suppressed a bounced subscriber and every newsletter report has read suppressed: 0. The sans-io refactor is NOT here: it was reverted deliberately when the week's quota ran short, because a half-refactored IMAP client in a tree carrying live mail is the worst place to stop.

written by Jason Hoogland <hoogland@gmail.com>

deliver resolved MX records and then ran the loop that matters -- preference order, which failures earn another exchange, whether the collapsed error is permanent -- and none of it could be reached by a test, because try_one hard-coded port 25 and the targets came only from a live lookup. It carries jarrah's outbound mail and had no coverage of any kind. deliver_to_exchanges takes the exchanges as an argument. It is private and reads nothing from configuration: this is not a way to say where mail goes, it is a way for a fixture to stand in as an exchange. DeliveryTarget gains a port field, always 25 from the resolver, so a stand-in can sit on a loopback port. Eight cases. Delivery must NOT authenticate even where the exchange advertises AUTH, since it is a mail server's conversation and not a mail client's; an advertised STARTTLS refused with 454 must still deliver in the clear, because opportunistic means opportunistic and refusing would stop mail to any exchange having a bad day with its certificate; a 550 stays permanent through the collapse while a 450 does not; and one permanent refusal survives a later transient one. The preference case earned its comment. Written with a banner-refusing exchange it passed with sort_by_key deleted -- a fixture that records nothing has an empty transcript whether or not it was ever dialled, so the assertion could not fail. It refuses at RCPT TO now, which leaves a trace that distinguishes the two. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

One word at tests/main.rs:29 was "dns". test_it matches a tag by prefix and no tag in email.rs, http.rs, smtp.rs or smtp_submit.rs begins with "dns", so every case in all four was skipped -- while the target printed "running 1 test ... ok" in 0.00 seconds. A filtered-out suite reads exactly like a passing one, which is why nobody looked. Now "all", and the suite goes red on two cases that have been dead since they were written. Neither is fixed here, because neither is this lane's: email.rs:76 'Mbox reader 000' opens /home/jason/tmp/Inbox and fails NotFound. It can only ever have passed on the machine that happened to hold that file. http.rs:36 declares Content-Length: 25 over a 26-byte body, so the reader correctly returns 25 bytes and the case asserts against 26. The parser is right; the fixture is one short. The four SMTP submission cases pass, as does 'Smtp commands 000'. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The round-trip in fe2o3_mail/tests/imap_roundtrip.rs proves the happy path against fe2o3's own ImapServer, and cannot pose the cases where this client is either right or quietly compromised: a BYE greeting, a POP3 banner, a literal larger than the client will allocate for, a tag it never sent, a server that hangs up mid-command, and bytes pipelined behind a STARTTLS response, which is RFC 2595 3.1's downgrade attack and had no coverage at all. Twenty-three cases against a scripted server on loopback. Four of them assert what did NOT cross the wire -- the password withheld from LOGINDISABLED and from an unsecurable connection, the bearer token withheld from a server without XOAUTH2, the APPEND body withheld from a mailbox that refused it -- and four read the client's own words back off the wire rather than trust the function that wrote them: the collapsed UID set, .SILENT on every STORE, EXAMINE as the verb, and RETURN (SPECIAL-USE) only where it was offered. The reader gets the case it exists for: a literal spliced mid-line whose payload holds a CRLF, a close paren and a {17} of its own. Until now only the parse function saw that; the reader that assembles the logical line did not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The four submission cases in fe2o3_net/tests/smtp_submit.rs had never run: tests/main.rs gates every case behind one filter string, and that string is "dns", so test_it matched nothing and the harness reported the file green at 0.00s. Twenty-two cases now live in the module itself, where no word elsewhere can switch them off, and they drive the whole conversation against a stand-in provider on loopback rather than construct a config: the order of EHLO/AUTH/ MAIL/RCPT/DATA, AUTH PLAIN's RFC 4616 encoding, the AUTH LOGIN fallback, dot-stuffing on the wire, multi-domain recipients, and four refusals proved by what did NOT cross the wire afterwards. Two of them found a live defect. is_permanent read one error frame, and res! wraps a cause in an Error::Upstream carrying no tags of its own -- so the Permanent tag set on a 5xx in transact was hidden by the single res! between it and every caller. The predicate answered false to every permanent failure there has ever been. fe2o3_steel's subscriber list therefore kept mailing addresses whose servers had refused them outright, and deliver's own re-tagging was inert for the same reason. It now walks the chain, and deliver reads the predicate rather than repeat the shallow check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

validate_egress looped over api_routes only, so an operator who had written an egress_allowed list -- a deliberate statement of which hosts this vhost may reach -- had it bypassed by a ws_route, a proxy_route, or a webhook route in forwarding mode. Three of the four outward reaches were outside a control that claims to cover egress. Not exploitable in the current configuration: every ws and proxy upstream deployed today is 127.0.0.1, which is on the allow-list anyway. Found by reading, not by an incident. The enumeration and the matching are now each in one place -- egress_targets lists what can reach out, egress_permits decides whether an entry permits it -- so a route kind added later is a failing test rather than a second check that disagrees with the first. An entry was also read as host:port at the first colon it contained, which meant a bracketed IPv6 entry could never match its own upstream: an allow-list that reads as populated and permits nothing. The port is now taken from the last colon and only when it parses as one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

`office:document-styles` is a SEQUENCE -- font-face-decls, styles, automatic-styles, master-styles -- and the presentation branch opened `office:automatic-styles` before `office:styles`, so every `.odp` came out with those two the wrong way round. `.odt` and `.ods` take neither branch and were always in order, which is why only the deck was wrong. Moving it also merges the two `if slides` blocks into the one they should always have been, since the automatic styles exist only to define the PM1 page layout and dp1 drawing page that the master page immediately below refers to. The test checks all three formats rather than the one that broke, and asserts the deck still HAS all three elements -- a sequence check that passed by finding only `office:styles` would prove nothing.

written by Jason Hoogland <hoogland@gmail.com>

The OASIS grammar defines that attribute in `office-document-attrs`, and the only element referring to those is `office:document` -- the root of the FLAT single-file form, which has no `mimetype` member to carry the fact instead. A package does have one, so on `office:document-meta` the attribute is not merely forbidden, it is redundant. It hit `.odt`, `.ods` and `.odp` together because all three writers share `pkg::meta`, which is the same property that made it one fix. The parameter went with the attribute rather than being left unused. Found by validating against the OpenDocument 1.3 RELAX NG grammar. LibreOffice reads all three files either way.

written by Jason Hoogland <hoogland@gmail.com>

The module header already lists the tables Excel insists on and the schema does not require -- the two named fills, one font, one border, one cellStyleXfs entry -- because Excel's answer to a missing one is a repair prompt that names no reason. `cellStyles` belongs on that list and was not on it. It holds the named style a cell wears when nobody has styled it, and Excel writes `<cellStyle name="Normal" xfId="0" builtinId="0"/>` in every workbook it saves. It goes after `cellXfs`, where CT_Stylesheet's sequence puts it. openpyxl warned "Workbook contains no default style" over every workbook this crate wrote and said nothing over LibreOffice's, which is what pinned the omission on us rather than on the reader. The warning is now gone. The test walks the six required tables in CT_Stylesheet's order rather than merely looking for the new element, since a `cellStyles` before `cellXfs` would be invalid however right its content.

written by Jason Hoogland <hoogland@gmail.com>

`sheet_name` stripped the characters Excel refuses and truncated at 31 and never looked at the names already issued, and `Book::from_doc` names a sheet after the heading above its table. So `## Q1/Q2` and `## Q1:Q2` both became `Q1 Q2`, and any two headings agreeing for 31 characters collided after truncation. Excel refuses a workbook with duplicate tab names, and refuses the FILE rather than the name. The first two rules are properties of a name alone; uniqueness is a property of the SET, and nothing looked at the set. So the whole job moves to `sheet::tab_names(book)`, which both writers now call -- the `.ods` writer had no deduplication at all, and OpenDocument wants distinct table names too. Both formats take the same names, so a sheet answers to one name whichever format a caller is holding, which matters because an edit names its sheet. A collision is disambiguated ` (2)`, which is what Excel does when you copy a sheet, with the head cut back to keep the result inside 31. `Book::from_doc` now keeps the heading WHOLE. Truncating in the neutral model put one format's limit where it does not belong, and threw away the characters that tell two long headings apart before the writer that must tell them apart could see them. Why a reader-based oracle could not find this: LibreOffice and openpyxl each silently RENAME the second sheet, so the file opens and the user merely does not get the tab they asked for. openpyxl's "Title is more than 31 characters" warning on every such workbook turned out to be a symptom of its own repair -- appending a digit pushed the name to 32 -- and it went when the cause did.

written by Jason Hoogland <hoogland@gmail.com>

pptx/parts.rs wrote type="titleAndBody" on p:sldLayout. That is the obvious guess and it is not in the enumeration; ECMA-376 Part 1 §19.7.15 lists 36 tokens and the two that mean title-plus-body are `tx` and `obj`. Now `tx`, which is "Title and Text". LibreOffice converted the deck without a murmur, so only the ECMA schemas were ever going to catch this one. The test copies the 36 legal tokens out of the spec rather than reading the writer's own constant: a test that read the constant would have agreed with `titleAndBody` just as readily.

written by Jason Hoogland <hoogland@gmail.com>

xlsx/edit.rs set the drop flag from `s.formula.is_some()` -- the formulas being written -- so a plain value written over a formula cell left `xl/calcChain.xml` naming a cell that no longer holds an `<f>`. `cell_markup` splices a whole new `<c>` over the old span, so the `<f>` goes with it. ECMA-376 Part 1 §18.6.1 says a `c` in the chain is "a single cell, which shall contain a formula", so this is a spec violation where the already-handled case is only a stale hint, and Excel's answer to a wrong chain is a repair prompt that never names a reason. Emptying the part would not do either: CT_CalcChain requires at least one `c`. The part goes, with its content-type override and its workbook relationship, as it already did for the other direction. Found by the ECMA-376 schemas in dev/verify_ooxml.mjs. No reader on this machine reads the part, so nothing else could have found it. The test grafts a chain onto foreign.xlsx, because LibreOffice writes none and `drop_calc_chain` had therefore never once had a chain to drop -- a removal proved by never being invoked. It asserts the fixture HAS a chain before asserting anything is removed, and asserts the chain SURVIVES a plain write over a plain cell, so the flag cannot be "drop it always" under a narrower name.

written by Jason Hoogland <hoogland@gmail.com>

A trailing hunk from the codec sweep that arrived after its commit had gone: a two-line group banner cut to the 1-3 word form the style asks for, the fields beneath it saying the rest. Comment only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

The first four files of the text crate's pass, landed on their own because the sweep was stopped part way through the crate and a half-swept crate left dirty is a worse state than either finishing or not starting. 83 doc lines to 65, one stamp each, fences unchanged, code identical by comment-stripped comparison, crate builds. The other 37 files of fe2o3_text are untouched and still on the list, as is unicode/tables/, which is six generated files marked DO NOT EDIT and is excluded from the pass on purpose: hand-editing them would be undone by the next regeneration, so the 145 doc comments they carry want fixing in gen_unicode.rs's emission instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

Fifty-two AI-written files, 4,373 doc lines down to 2,929, and the stamp on each. This crate is from-scratch H.264, H.265, JPEG, PNG, MP4, Matroska and AVI, so the usual rule needed its opposite alongside it: the single most valuable comment in a codec is the one naming the clause of the standard a table or a step comes from, and a mechanical deletion pass is exactly what destroys it. Every specification citation survives. Where one sat on an enum variant or a constant, which the rule always strips, it was demoted to an aligned trailing `//` rather than dropped -- 111 demotions, of which 17 carry a citation, a fixture's provenance or a measured tolerance. The tests are mostly external oracles, and the same reasoning applies harder: a note recording which tool produced a reference value, at what version and with what flags, is unrecoverable once deleted. 34 such blocks kept in place, including ffmpeg's `-noautorotate` in film_posters.rs, "taken from the drawing rather than from the file" in apng_oracle.rs -- the line that says the oracle is not circular -- and "first *intra*, not first shown" in h264_corpus.rs. mp4_oracle.rs kept its whole per-function inventory and lost only its constant block. Three docs were describing code that does not exist: - matroska_frames.rs `gather()` claimed to follow no symbolic link twice. It uses fs::metadata, which follows symlinks, and keeps no visited set. The claim is removed; the recursion is still worth a look. - hevc_tiles.rs `Rgb` was documented as a brightness plane. read_png fills it with three interleaved channels. - raster.rs `square()` was documented as covering the middle four pixels of an 8x8 window. It is a general rectangle constructor called with a dozen coordinate sets in the same module. Code is unchanged, proved by comment-stripped comparison over all 52. Doctest fences 16 before and 16 after. 303 lib tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

The admin dashboard's module header still said SCOPE_DASHBOARD_ADMIN "enables mutations in a future v2 (edit ozone values)". That future arrived: the scope gates the address guard's whitelist and blacklist today, at handler.rs:1699, and the method's own doc was corrected yesterday while the header above it was not. A header is the first thing a reader of a module meets, so it was the last place that claim should have survived. Eight intra-doc links resolved to nothing, found by turning rustdoc::broken_intra_doc_links into a warning and reading it rather than by looking: - cas_o3db.rs twice pointed into `super::dist::o3db_storage`, which is behind the `dist` cargo feature and so is absent from a default build. Now plain text naming the feature, since a link that exists only under a feature flag is worse than no link. - cache.rs wrote "1 [MiB] = 1024^2 bytes", where the brackets were accidental and rustdoc dutifully looked for an item called MiB. - host_sampler.rs pointed at `traffic::TrafficRecorder` and `Server::start` from a module where neither path resolves. - feed.rs pointed at `valid_date`, which lives one module up. - console/publish.rs pointed twice at `DeclareConfig`, which lives in publish::declare. Both crates now emit no unresolved-link warnings at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_file/src/lib.rs was stamped "written entirely with AI" yesterday and the mark was removed when blame showed the author's own lines in it. It then declared nothing, which is a claim by silence and as wrong as the one it replaced. Blame puts it at 24 of his lines against 14 AI, 36.8%, which is the middle rung: he wrote the opening header and `pub mod tree`, and AI wrote the section on archives -- including the reason `office` lives in this crate rather than beside the document tree, which is that fe2o3_jdat depends on fe2o3_text, so fe2o3_text can never depend on the archive -- and four of the five module declarations. It is the only file in the library carrying a graded declaration. The other 144 mixed files carry none, because a mark is a claim about a whole file and their proportions are not measured one by one. This one is measured, so it can say what it is. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

A file the author wrote and an AI later added to cannot be swept by the rules that suit a wholly AI-written one: those rules delete a `///` on a struct field, and in these files some of those are his. So the unit here is the line rather than the file. Every line is attributed with `git blame -w -M -C`, using the same classifier as the provenance audit, and only a doc block attributed wholly to AI commits is removed. 1,690 lines across 54 files. Three deliberate conservatisms, because the two errors are not symmetrical -- wrongly keeping an AI doc costs one surplus comment, and wrongly deleting one of his loses a line of his writing: - A block with even one line of his in it is left entirely alone. Eight such blocks were found and none was touched. - A line the classifier cannot place counts as his. - A block carrying a doctest is left whole, as everywhere. Sixty-three. Verified by recording every doc line in these files attributed to him or to nobody -- 1,863 of them -- and confirming after the pass that all 1,863 are still present. Code unchanged by comment-stripped comparison, doctest fence parity holds in all 54 files, and the seven crates build. These files get no stamp. A declaration is a claim about a whole file and his lines are in every one of them. fe2o3_net, fe2o3_crypto, fe2o3_hash and fe2o3_iop_crypto are excluded: the first has a live sans-io refactor in it, and the other three are where a key-agreement design is being worked out this evening, which should follow the code rather than the other way round. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

Six AI-written files across fe2o3_crypto and fe2o3_hash, 328 doc lines down to 161, and the stamp on each. Swept ahead of their turn because the Ore session is about to write a design note across these two crates and would rather cite line numbers that have already moved than have them move underneath it. The security warnings are the point of the pass here, not its casualty. Wallet::enrol, change_password and remove_by_name each authenticate nobody -- they exist for a host that unlocked at startup and is carrying the master key -- and each now says so in one bold clause instead of five lines of surrounding narrative. unlock keeps the reason its expiry check runs after the wrap decrypts rather than before: an expired admin holding the right password is told it has expired, because once you have proved you hold a credential the system says why it still refused you. SignedCommand::verify keeps that it verifies the signature and nothing else, so a replayed command passes it. sha256.rs was already right and lost almost nothing: the round constants are the first thirty two bits of the fractional parts of the cube roots of the first sixty four primes, and that sentence is why anyone can check the table. It moved from a `///` to a `//`, because the rule keeps facts and not the sigil they arrived in. Its FIPS 180-4 vector provenance is untouched, as is the note in tests/phash.rs recording that an external tool produced each variant. Code is unchanged, proved by comment-stripped comparison. Doctest fences unchanged. fe2o3_hash tests pass, 29 across six binaries. fe2o3_crypto's test harness does not link, and does not at HEAD either: rust-lld reports jent_entropy_collector_alloc and three more jitter-entropy symbols undefined, from pqcrypto-internals' C build. Confirmed pre-existing by restoring all six files to HEAD and rebuilding, then restoring the pass and checking the md5s. The library itself builds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

HttpMessageReader keeps whatever it took off the stream past the end of a message in a private buffer. A keep-alive loop needs no accessor -- the remnant is the front of the next message and the next next() consumes it. A caller that stops reading HTTP and takes the raw socket does: at a protocol upgrade the 101 is the last HTTP on the connection, and the remnant is the front of the next protocol's first message. Dropped, it is invisible almost always, because a client waits for the 101 before it frames anything. On the occasion a client pipelines its first frame, or one TCP segment carries both, the new protocol's stream is missing its first bytes -- and a stream missing its first frame does not fail, it decodes to nonsense. Occasional silent truncation in a byte pipe is the shape of bug nobody can report usefully, so the bytes are made reachable rather than left to each caller to notice they are gone. remnant() borrows, into_remnant() takes. Two tests: an upgrade request with a masked binary frame behind it in the same buffer keeps the frame, and a request with nothing behind it leaves nothing -- the second so an accessor that invented bytes would be caught as well as one that lost them.

written by Jason Hoogland <hoogland@gmail.com>

The five declaration levels are fixed words and all five carry the qualifier at the end: made with no AI, with some AI, with AI, mostly with AI, with AI entirely. The code stamp introduced yesterday wrote the top rung as "Written entirely with AI", which reads better and is a different sentence. It is now "Written with AI entirely" in all 320 stamped files. The scheme's whole claim is that a slug, a mark, a wording and a page say one thing, so a stamp that words the claim differently from the page it links to is the one defect the scheme cannot afford. need2know.ai now serves "written" as the verb for the code medium at every level, so /entirely-ai/code reads "This code was written with AI entirely" and the stamp above matches it exactly. The other five media keep "made". The URL and the slug are unchanged, so any badge or QR code already printed still resolves. Nothing but the stamp line differs in any of the 320 files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

Forty AI-written files, 3,115 doc lines down to 2,025, and the stamp on each. The rules are the usual ones: no `///` on an enum variant, a struct field or a constant, no `# Returns`, and nothing that restates the name it sits above. Where a deleted doc carried a fact it became an aligned trailing `//`. This crate is mostly wire contracts, so the exemption did most of the work: the docs that survive say what a peer does with a value, which RFC governs it, or why the code departs from the specification, and the ones that went were re-spelling an identifier. http/pct.rs came through with its doc count unchanged, because every comment in it already stated a rule the signature does not carry. jose.rs keeps the `///` on TEST_P256_PKCS8 and TEST_P256_THUMBPRINT_B64, which record the openssl and python3 derivations of those values -- where a fixture's expected value came from is the one thing a reader cannot recover. Three comments were found to be describing code that does not exist: - dkim.rs: the doc for `sign` had been glued onto the front of `signing_input`'s, running straight on with no break, while `sign` itself had none. Split, and each now sits on its own function. - dkim.rs: `DkimSigner` was documented as owning a live Ed25519KeyPair. It owns a DkimKey, which has been Ed25519 or RSA since RSA was added. - dns_resolver.rs: `lookup_a` claimed to return answers after CNAME chasing. It chases nothing, and an inline comment eight lines into the parser says so. The claim is gone; the resolver's handling of a CNAME is still worth a look, but that is code and not this pass. Two more are documented rather than changed, both in acme/: a certificate and its key are written by two separate atomic writes, so an interruption between them leaves a new certificate beside the old key and the both-or-nothing check does not see it; and poll_until_ready returns on Valid as well as Ready, which is right but not what its name says. Code is unchanged, proved by stripping every comment from both the committed and working copies with a lexer that understands raw strings, byte and char literals and lifetimes. Doctest fences 20 before, 20 after. 296 lib tests, 9 integration tests and 4 doctests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

RFC 6455 §7.4.2 leaves 3000-4999 to the application, and TryFrom refused the whole range -- so a caller whose protocol lives there had its peer's close frame turned into a read error. Private(u16) decodes it and maps back unchanged. The range is not widened to "anything": the tests assert that 1004, 1014, 2999, 5000 and 65535 are still refused, because a peer's typo should not arrive as a meaning. Written by a subagent of mine at 15:13 and left uncommitted, which is how it came to sit in a shared tree for five hours while I told two peers it was not mine. It was found by a third session reading the subagent transcripts I had not read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The doc claimed the result was clipped to what the sheet holds; it is not, and should not be. Its one caller draws a grid in the browser, and a grid that shrank whenever the far corner was empty would be worse than one with empty cells in it. So the sentence was the defect, not the loop. Found by the documentation-sweep session reading it cold, which is the third comment today that described behaviour the code does not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The other half of 600e8e9, by the same method as Shield: remove the lines git blame still attributes to it that are `///`, leave everything else. 546 lines across 18 files, and none of them was a doctest. Twelve of the removed blocks sat on functions and were read before going. Not one carried a fact its own body did not already state four lines below: choose_cbot_select's doc described taking the low sixteen bits modulo the zone count and the next sixteen modulo the pool count, above a body that is those two lines of arithmetic and nothing else, and clear_all_values explained that locations survive above a loop that sets `*val = None` and touches nothing else. The author's own documentation in these files is untouched, including the worked forward-and-reverse-map diagram in data/cache.rs, which is the kind of thing a doc comment is for and which no signature could carry. Code is unchanged, proved by comment-stripped comparison. Lib tests 23 pass, as before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

Commit 600e8e9 added 975 doc comments across fe2o3_shield and fe2o3_o3db_sync in one pass, onto two crates that had deliberately been left sparse. In srv/cfg.rs it put a `///` above every field of ServerConfig, each restating a `//` banner the author had written in 2024 and the field name beside it; in srv/constant.rs it did the same to a table whose alignment and trailing `// 30 min`, `// 3 days` notes had said all that needed saying. This removes the lines git blame still attributes to that commit and that are `///`, in the Shield half. Blame rather than a revert, so that a line edited since is left alone as somebody's considered change, and so that the 75 plain `//` comments and 13 lines of code from the same commit stay. A doc block carrying a doctest is kept whole. Fourteen of the removed blocks sat on functions and were read individually before going. Three looked like they carried a fact worth keeping, and on inspection none did: get_trusted_seeds states its minimum in the `if` on its first line, sig_state's three strings are the three match arms below it, and new_db's cipher is named by the type aliases in its own signature. A doc repeating a value defined elsewhere is a second place for it to go stale, which is how five docs in Steel came to contradict their code. Code is unchanged, proved by stripping every comment from both sides with a lexer that understands raw strings, byte and char literals and lifetimes, and comparing what is left. Also ignore .claude/worktrees/, 104 MB of agent checkouts sitting untracked in the repository root, one blanket `git add` away from being committed into the tree they are a copy of. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RNqYLm5UQGxLZ7TJ3vFSez

written by Jason Hoogland <hoogland@gmail.com>

A third entry kind: the record header in clear beside the whole tagged entry encrypted. The header is what a session needs and the whole of what it needs -- an identifier and its parents -- so a carrier can walk frontiers, reconcile sketches and hand operations on while being unable to read a byte of what they say. What goes under the cipher is the entry's own tagged form, so a sealed envelope unveils to a sealed envelope and the signature made before the veil is the signature checked after it. The clear header is compared with the signed one on the way out and a disagreement is refused by name, naming the signed copy as the one to believe. peek refuses a veiled entry rather than answering with a stand-in, since every caller of peek asks in order to read an operation. Veiling does not nest, and the body is written under a 64-bit length only, so one veiled entry has one spelling and one digest. The format version does not move. A kind is a separate axis from the vocabulary: bumping it would shift the version byte in two frozen arrays for a change that alters no plain record, and would make every public repository's fresh segments unreadable to an older build for a form only private ones use. The relay publishes the kinds it speaks instead, which is the capability a caller actually needs to know. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

5,644 doc lines to 3,576 across the 48 files with no surviving human line. The cut is smaller in proportion than elsewhere because much of what Steel documents is a wire contract or a security property: RFC citations in cache.rs, what a route serves unauthenticated, what a credentials endpoint will and will not disclose, and the config fields where a wrong value is not a typo but an exposure -- the egress allow-list, trusted_proxies, site_admins, the rate limits. Those keep their documentation. Five docs had stopped being true of their code and are corrected, each checked against the body first. can_admin_dashboard said it gated nothing because the dashboard was read-only; it gates the address-guard mutation today. render_traffic said the view had no auto-refresh; the page embeds it. The signed-login TTL said it matched the passphrase flow at one hour, where that flow is thirty minutes. A DKIM doc still described a single signer above a vector of them. An alert doc said the same thing twice. Ten doc blocks were sitting on the wrong item -- each carrying the prose of the function above it, which had been left undocumented. They are moved back, or deleted where the stray half only restated a name. One field doc survives the never-document-a-field rule, because it carries a fenced openssl command and the never-delete-a-doctest rule outranks it. That is what holds the fence count at 32, in and out. Left alone, and wanted: the module header of srv/admin/mod.rs still says the dashboard scope is for a future v2, which is the same claim corrected above. Headers were out of scope for this pass. Verified independently of the agent that did the work, which had to repair four slips of its own along the way: every comment stripped from both revisions, string- and char-literal aware, and what remained compared. Code identical in all 78 files of the crate. The library builds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_o3db_sync is half the author's code and half not, so only the 42 files with no surviving human line were touched or marked. The other 60 were left alone entirely, including their own excess. 1,324 doc lines to 641. What survives is what a second implementation would have to agree with: the on-disk shapes, the key encodings, the gear seed whose change would orphan every content address, the IBLT hash count both ends of anti-entropy must match, XOR distance and bucket semantics, cohort seed derivation, and the durability and ordering promises. Three docs were wrong about their own code and are corrected. ViewId said the crate only ever uses view 1; on_timeout increments it and on_new_view drives the change. Cas::put_bytes said it chunks its argument; it stores it whole, as one chunk. A test helper documented three return values against a four-tuple. Several intra-doc paths were stale from the lift of standalone crates into this one -- crate::config, crate::cohort, crate::placement, all now under crate::dist -- and one pointed at a field that does not exist. Left alone and worth a pass: the module headers carry the same stale paths, plus references to a fe2o3_hotstuff crate that is now src/dist/hotstuff and two headers calling a module a crate. Headers were out of scope here, so they will show as broken_intra_doc_links until somebody takes them. Verified by stripping every comment from both revisions, string- and char-literal aware: code identical in all 102 files, and the 28 doctest fences are untouched. The library tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

Correcting the epoch alone made things worse, which is what pointed at the real defect. The epoch was 1948439, the astronomical one, while every sentence in the file and the copy in calendar.rs both name 16 July 622 Julian, which is 1948440. Setting it to 1948440 on its own moved 1 Muharram 1445 from 19 July 2023, the right answer, to the 20th. Two errors had been cancelling. The second was the arithmetic. Year starts were counted as floor((year - 1) * 354.36708), a mean year length, which drifts a day at a time and disagrees with is_islamic_leap_year twenty lines below -- that decides the length of Dhu al-Hijjah from the thirty-year cycle, so month lengths followed the cycle while year starts followed a float. Years are now counted the same way: 11 leap years of 355 days and 19 common ones of 354, which is 10,631 days a cycle. Months alternate 30 and 29 from Muharram, so the months before one hold 29 each plus one more for every odd-numbered one. The floats that remain only seed the search loops in jdn_to_islamic, which correct themselves against islamic_to_jdn, so they are estimates and stay. A year before 1 is now refused rather than answered with nonsense. Checked against dates outside this crate: 1 Muharram of years 1, 1444 and 1445 come out as 19 July 622, 30 July 2022 and 19 July 2023, which are the announced dates. 1446 gives 8 July 2024 against an announced 7 July -- the one-day difference between an arithmetic calendar and a sighting, which is the tabular calendar working rather than failing. Two tests were wrong and are corrected. test_islamic_epoch expected 16 July 622 Gregorian; the epoch is 16 July Julian, which is 19 July Gregorian, and the assertion is now exact rather than a three-day window -- that window is why a one-day epoch error survived. test_days_in_islamic_month had 1445 and 1446 the wrong way round: 1445 sits at cycle position 5 and is a leap year, 1446 at 6 and is not. All 7 Islamic tests pass, against 5 before. The crate is 245 passing and 9 failing, unchanged by this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

Two findings from the documentation pass, one fixed and one deliberately not. test_leap_second_detection asserted that 2017-01-01 23:59 carries a leap second. It does not. The leap second the table records as "2017-01-01" was inserted at the end of the preceding day, as 2016-12-31T23:59:60Z, and that instant is 1483228800 -- exactly the entry the table holds. The table entry is the moment the new TAI-UTC offset takes effect; the date carrying the sixtieth second is the day before it. So validate_leap_second was right and the test named the wrong day. Checked against the epoch arithmetic rather than reasoned: 2016-12-31T23:59:59Z is 1483228799, and the leap second follows it. The Islamic epoch is a decision rather than a typo, so only its documentation is corrected here. The doc had the two calendars the wrong way round: 1 Muharram 1 AH is 16 July 622 in the Julian calendar, which is 19 July 622 proleptic Gregorian, not the reverse. Underneath it, ISLAMIC_EPOCH_JDN is 1948439, which is 15 July 622 Julian -- the astronomical epoch -- while every sentence in the file names 16 July 622, the civil epoch, which is 1948440. Both conventions are in use. Correcting the constant moves every date this calendar converts by a day, and test_islamic_epoch expects a third answer again, so the disagreement is recorded where the constant is and left for a decision. 243 tests pass, 11 fail, against 242 and 12 before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_datime is the crate the old documentation rule hurt most, and the largest single cut of the pass: 4,971 doc lines to 877, and a need2know mark on all 122 files. Every one of them was verified to hold no surviving human-written line first, so the claim is true throughout. It documented very nearly every public item, because CLAUDE.md said to and its worked example showed how -- an `# Arguments` block naming year, month and day, and a `# Returns` restating `Outcome<Self>`, on a constructor whose parameters say everything. That example is gone from CLAUDE.md now, and this crate is what it produced. Ninety files had no module header at all and nineteen had one written as `///`, attached to the first `use` statement rather than to the module. Those nineteen are now `//!` at the top of their file where they belong, which is a correction rather than a cut. Where a file's opening prose was really module-level and had been living on an over-long struct doc, it was moved up rather than deleted. Kept whole: the pattern-syntax table and the accepted-input list, which are token meanings and a parsing contract; the calendar lore, which is the valuable part of this crate; and every doctest, 96 fences in and 96 out. Demoted rather than dropped, because a name does not carry them: JavaTime being milliseconds, IndexKey::Timestamp being Unix milliseconds, DayOfWeek counting Monday as one, the RFC 9557 precision characters, the cron field ranges, and the arithmetic split where the Self forms error on overflow while the _long forms saturate. Four claims were corrected rather than preserved, each checked against the body first: an O(1) access time on a cache that is O(n) by construction, and three rates documented as percentages that return a fraction. Left alone, and worth a look: the enum in business_day_engine.rs whose variant docs each sat one variant below the text that fits them; is_valid_second, which says it allows leap seconds and rejects sixty while the rest of the crate treats sixty as valid; and the fenced examples throughout, which the old ?-to-ok! sweep corrupted into things like CalClockZone::utc()res!(). They are ignored, so they never ran, and they are not comments to cut. Verified by stripping every comment from both revisions, string- and char-literal aware: code identical in all 122 files. 242 tests pass and 12 fail, which is exactly what HEAD does -- checked by stashing this pass and running it again. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

`deck-write`, on by default, so nothing changes for any caller that does not ask. It covers `pptx::write`, `pptx::parts` and `odf::slides::write` -- the slide master, layout and theme a PresentationML package cannot open without, plus the OpenDocument presentation writer. READING a deck is unconditional and stays so: a reading view offers six formats and dropping one would change what a user already has. Both writers keep one signature either way. Built without the feature the call returns an error naming the feature rather than an empty file, so a caller does not change and a person is not handed a `.pptx` with nothing in it. Measured on Daimond's browser bundle, both builds from one tree state and the "on" build reproduced byte for byte: 3,403,232 bytes with, 3,346,025 without -- 57,207 bytes, 1.68% of the bundle, 12 functions and 44,065 of them in the code section. Not a decision to ship it off; a number to decide with. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The second crate through the documentation pass. 1,281 doc lines to 731, and a need2know mark on the 41 files that earned one. Four did not. src/tree.rs, tests/tree.rs and tests/main.rs date from the 2024-12-25 import, carry no doc comments at all across 285 lines, and are written in the author's hand; marking them would be a false claim about who wrote them, and they were left untouched entirely. src/lib.rs is the awkward one: it dates from 2024 too, and although its header reads as AI-drafted and its second half was added in 2026, git blame -w -M -C puts it at 23 human lines against 16 AI. A file that is 59% the author's cannot carry "written entirely with AI", so the mark came off again. It wants a graded declaration rather than this one. Every other stamped file in this crate, and all 27 in fe2o3_ore, has no surviving human line at all, so the claim is true where it is made. The wire-contract exemption did most of the judging here. A constant whose value is fixed by a specification and read back by another program keeps its documentation: the EXIF tag numbers, the ZIP date encoding, OLE_MAGIC, the OOXML numbering identifiers that must resolve across two parts. What does not survive is a doc that merely re-spells the constant it sits on -- the twenty-five namespace, relationship and content-type strings in office/opc.rs now carry one banner between them, which says the thing the twenty-five sentences were each saying a quarter of. Kept: every doctest, 16 fences in and 16 out; the format lore that cost somebody a debugging session; and the glob precedence rules, which are the kind of fact no reader derives. Two defects found and deliberately not fixed, being content rather than cuts. Sheet::window is documented as clipping to what the sheet holds and does not clip. Three docs named parameters or behaviour that do not exist, and trimming their restating first lines removed the error as a side effect rather than by intent. Verified by stripping every comment from both revisions, string- and char-literal aware, and comparing what remained: identical in all 45 files. The suite and both doctests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_ore is the first crate through the documentation pass, and the first to carry a declaration of who wrote it. Every file gains one need2know mark at the foot of its module header, linking to need2know.ai/entirely-ai/code. The claim is true of this crate: no line of it predates the AI era, and nothing in any pre-2025 snapshot matches it. The cut is 4,219 doc lines to 2,455, and it is deletion rather than shortening. Per comment the length was already right -- the AI writes roughly what the author writes, sometimes shorter. The volume was coverage. Measured on the 2024-12-25 tree the author documents 15.2% of public functions, 1.3% of struct fields, 0.4% of constants and none at all of 1,688 enum variants; this crate documented nearly everything, because CLAUDE.md told it to. That rule changed today, so what follows it is the practice rather than the aspiration. So: no doc on an enum variant, a struct field or a constant, and no `# Returns` on anything. Where a deleted doc carried a fact, it moved rather than went -- to an aligned trailing comment, to a banner above a group, or to a plain comment block where the reason was too long for a line. Constants follow the author's own ladder, which reserves a doc comment for a value that is a contract with a history. Kept whole: the module headers, which are good; the inline comments inside functions, which the author writes more of than the AI does; the test docs that record why a case is an honest loss rather than a defect; and every doctest. Left exactly as they stand, because another session owns them and is about to add a third entry kind: KIND_BARE, KIND_SEALED, VERSION, VERSION_MIN and the Entry variants that name them. Verified by stripping every comment from both revisions, string- and char-literal aware, and comparing what remained: identical in all 27 files. 339 tests and 4 doctests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

Eleven tests over foreign fixtures, and an example that hands a real reader a file this crate edited. Every fixture is one LibreOffice wrote, because the property being tested is that an edit leaves a STRANGER'S file intact and a file this crate wrote has none of the constructs that would be lost. WHAT THE ORACLE FOUND, and what no self-test could have. The first .ods cell writer put a cell's displayed text in as bare character data rather than in a `<text:p>`. A numeric cell still showed, because it carries `office:value` -- so the round trip through this crate's own reader was green. A STRING cell showed as EMPTY, because a string cell's value IS its paragraph. The mistake therefore lost exactly the cells it is hardest to notice losing, and it took a second implementation's opinion to see it at all. That is now the second session running in which LibreOffice has caught a data-loss bug in ODF output that reading our own output called correct. The tests are written to assert the property and not the outcome: * A replacement over four runs checks FIRST that the phrase does not stand in the part's XML as one string. Without that, the test would pass on a fixture that made the join unnecessary and the join could rot unnoticed. * An edit's preservation is checked on the compressed bytes of every other member, not their content. A member rebuilt with the same content and another compression level is a member that was not copied, and copying is the whole claim. * A formula's text is asserted, out and back. Presence was what the earlier test checked, and presence is what let the bracketing asymmetry sit between two green tests. * A cell written into a gap checks its NEIGHBOURS on both sides and every other row, since a mishandled repeat run moves values rather than losing them. * `typed` is checked on what it must NOT convert as much as on what it must. `examples/edit_office.rs` takes a file, a list of edits and an output path, so `soffice --headless --convert-to` can be pointed at the result. A test that reads back what this crate wrote proves that this crate agrees with itself, which is worth very little for a format whose whole purpose is to be opened by somebody else's program. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

The other half of the third verb, and it is not find-and-replace: a spreadsheet's unit is a cell, so the argument is a reference and a value. Both formats, answering the same way, which is the property the tests assert rather than testing each in isolation and letting them drift. A SHEET IS SPARSE, SO A WRITE IS AN INSERTION AND NOT AN ASSIGNMENT. There is no array to index. In a .xlsx a row may be absent and `<c r="D3">` may follow `<c r="A3">` with nothing between, so writing B3 means finding where B3 WOULD go: among the cells of row 3 if that row exists, and as a new row in the right place among the rows if it does not. A writer that appended would put the value in the wrong column, or the wrong row, and the file would still look like a file. .ods states the same problem in its own dialect and states it harder. A run of identical cells is written once as `table:number-columns-repeated="8"`, and a run of identical rows the same way, so writing C4 means finding which run covers it and SPLITTING that run into the part before, the cell, and the part after. Left alone, every value to the right of the edit moves one column -- a corruption that looks like a spreadsheet. LibreOffice writes exactly this shape for any sheet with a gap in it, so it is the ordinary case and not the awkward one. TWO PARTS OF A .xlsx ARE REWRITTEN BESIDES THE CELL AND BOTH HAVE TO BE. `<dimension>` says the rectangle the sheet occupies and is widened, since a cell outside it is one some readers do not draw. `xl/calcChain.xml` is Excel's record of what order to recalculate in and it names cells by position, so a formula written into a cell the chain does not know makes the chain wrong -- and Excel's answer to a wrong chain is a repair prompt, which "fixes" the file and never says why. The part is deleted whenever a formula is written, with its content-type override and its relationship, and Excel rebuilds it. Nothing recalculates, here as everywhere: a written formula goes in with no cached value and the reader works it out on open. Leaving the value that was there would leave the value of the OLD formula, and a cell showing a number that does not follow from the expression above it is worse than one showing nothing. TWO WRITES TO ONE CELL IN ONE CALL ARE REFUSED, and before this the two formats disagreed about it in the worst possible way: the .xlsx path failed with an internal overlapping-splice error and the .ods path silently took the first and dropped the second. There is no order for them to be applied in -- nothing here reads a cell it has written -- so "the last one wins" would be a rule about how a caller happened to build a list. Both now refuse, naming the cell. AND ONE READER BUG, WHICH TWO PASSING TESTS HAD BEEN HIDING BETWEEN THEM. `odf::sheet::write` brackets a formula's references as OpenFormula requires and nothing anywhere took the brackets off again, so a formula written by this crate read back as `[.B2]*[.C2]` while the same workbook as a .xlsx read back as `B2*C2`. Neither existing test was wrong: the writer's checks the bytes it produces, the reader's checks that a formula came back AT ALL. There was simply no test that went out and back. `plain` is the inverse of `openformula` and the reader now applies it. Note what could NOT have found this -- LibreOffice, which is perfectly happy with the file, because the file was correct and the reader was not. The neutral sheet gains the three functions both writers needed. `typed` is the rule a person meets when they type into a cell, and its one subtlety is what it REFUSES: a string is a number only where it is exactly how that number prints, so `007`, `+3`, `1,000` and ` 4 ` stay text. A rule that parsed anything parseable would silently renumber a column of part numbers. `stored` is the shortest text that reads back as the same f64. `Book::from_doc` is the counterpart of `Deck::from_doc`: one sheet per table in a document, named by the heading above it, so a caller that can produce Markdown can produce a spreadsheet without producing a file format. A heading is cleaned of the seven characters Excel refuses in a tab name and cut to 31, because Excel refuses the whole FILE over a name and not just the name. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

Creating a document and reading one both go through the neutral tree in fe2o3_text::doc. EDITING one must never be made to, and the reason is the tree's own argument for existing: it deliberately cannot carry markup it has no node for. That is exactly right for the first two verbs and exactly wrong for the third, because everything the tree cannot represent is everything an edit through it would silently destroy -- the comments, the bookmarks, the tracked changes, the content controls, the custom XML, the theme, the tab stops. Read to Markdown, edit the Markdown, write a fresh file, and what comes out opens, looks about right, and has lost all of it. The person who finds out is not the user; it is the colleague they sent it to. So an edit splices. `office::edit` holds what the two prose vocabularies share, and the shape of it is one observation: THE TEXT A DOCUMENT HOLDS IS NOT IN ONE PLACE. A sentence in a .docx is spread over as many `<w:t>` runs as the writer's formatting made -- a bold word, a spell-check mark, a bookmark or a language change splits one -- and an .odt spreads it over character data, `<text:span>` and `<text:s>`. A find that looked inside one element at a time would miss every phrase a writer had touched, which is most of the interesting ones. A paragraph is therefore a GROUP of pieces, its text is their concatenation, a match is found in the concatenation, and the replacement is pushed back down onto the pieces it covered: whole into the piece holding the START of the match, so it keeps that run's formatting, and removed from the pieces after it. Which is what a person doing it by hand would do. Every changed piece becomes one Splice; zip copies every member nobody touched. A document edited here differs from the one that arrived in exactly the runs that were edited, and the test that says so compares the COMPRESSED BYTES of every other member rather than their content -- two members can hold the same content and different bytes, and it is the bytes a colleague's reader parses. AN UNMATCHED `find` IS AN ERROR NAMING THE STRING, and nothing is written. A silent no-op is the failure this is written against: a caller told "the document was edited" has no way to discover that one of its four replacements did nothing, and will report the document as changed to somebody who then sends it. An `nth` past the end is refused the same way and says how many there are. Two whitespace rules are not optional, and both are the format telling you it will change your text if you do not obey it. A `<w:t>` needs `xml:space="preserve"` wherever the replacement has whitespace at an end. OpenDocument collapses a literal run of two or more spaces, and a space at either end of a run, so a replacement carrying one goes out as `<text:s>` -- and `<text:s>` is also read as text on the way IN, or `Q1 2026` would report as absent from a document holding `Q1<text:s/>2026`, which is what a person typed. Only the body is searched. A phrase in a header, a footer or a footnote reports as absent rather than being changed in one of two places, and an absence that names the string is a caller's cue to look. Deck editing is deliberately absent, and the refusal gives the reason rather than saying "unsupported": a slide is a position on a canvas, so changing words without knowing the geometry puts text over other text. A model told a thing is impossible stops asking; one told nothing tries again. `opc` gains the package navigation the readers each had a private copy of -- dir_of, resolve, rels_of, main_part -- so an editor finds the document part the way the package says rather than guessing at `word/document.xml`, which is a convention and not a rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MRT571VteeTte8KGUNFnHx

written by Jason Hoogland <hoogland@gmail.com>

.odt, .ods and .odp: written from the same three neutral models the Microsoft side uses, and read back into them. Simpler in one specific way -- there are no relationship parts, so the whole class of bug where a body names an id nothing declares cannot occur -- and harder in another, since one content.xml holds every sheet or slide. FIVE THINGS WERE WRONG AND EVERY ONE WAS FOUND BY LIBREOFFICE, not by a test of ours reading our own output: * `table:formula="of:=B2*C2"` is not OpenFormula. A reference must be bracketed -- `[.B2]*[.C2]` -- and written the other way LibreOffice cannot parse it, RECALCULATES, and writes Err:510 over the stored value. A wrong formula does not merely fail; it destroys the number. * And the `of:` prefix must be BOUND, to `urn:oasis:names:tc:opendocument:xmlns:of:1.2` -- not the plausible `...formula:1.0`. Unbound, every formula in the file fails the same destructive way. * A LEADING space is dropped by every reader, so all of a leading run has to go out as `<text:s/>`. Four spaces of indentation became three, in every line of every listing. * A style name a document does not DEFINE is dropped, span and all, so every bold word written here arrived as plain text. * And a reader must resolve styles by their PROPERTIES. LibreOffice names them `T1`, `P2`, `L3`; matching on the name finds this crate's own output and nothing else's. It also writes level TEN of a bullet list as a number, so asking whether ANY level is numbered turned every bulleted list in a foreign document into a numbered one. `mimetype` is first and stored in all three, and the test for it now has teeth: the obvious check is VACUOUS, because `mimetype` is the first member these writers add and comes out first whether `set_first` or `set` was called. The property is therefore checked on an archive that already has members, where swapping the call goes red. An interior run of empty cells or rows is a GAP and is expanded; only a trailing run is padding. Collapsing both put the total row two rows early. Known and said rather than quietly imperfect: an .odp's frames are not true placeholders, so a reader that re-saves the deck drops `presentation:class`. The words, order, nesting and positions survive and it renders correctly; the outline view does not. The reader is built so it does not matter -- where no frame claims the title, the first is taken as it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

A neutral deck -- slides of a title and bullets -- with a PresentationML writer and reader over it. Create, read and show; NOT deck editing. A slide is a position on a canvas, and an edit that changed the words without knowing the geometry would put text over the top of other text: a failure a reader sees and an editor cannot check for. The heaviest skeleton of the three, and structurally so. A .docx opens with four parts and a .xlsx with six; a .pptx needs a slide master, a slide layout and a theme before it can hold one slide, and the theme must carry three fill styles, three line styles, three effect styles and three background fills whether or not anything uses them. A file with any link missing gets a repair prompt naming neither the part nor the reason. LibreOffice converts the result to PDF and to ODP without one. Slide ORDER lives in p:sldIdLst and not in the file names: slide10.xml sorts before slide2.xml and is the ninth slide. The fixture's slide relationships start at rId3, because the master and the theme took the first two, so the red run for that break deals the master's own placeholder out as a slide -- "Click to edit the title text format". `Deck::from_doc` splits at EVERY heading. It split at the shallowest first, borrowing `Doc::top_heading`'s rule, which is right for finding a title and wrong for ending a slide: a document written `# Title` then `## Section` twice came out as one slide holding everything. And `Media` no longer collapses the four OpenDocument kinds into one, so a panel can tell a text document from a spreadsheet. The kind is read from the archive's own `mimetype` member rather than from the filename, which is not a guess: OpenDocument REQUIRES that member first and stored uncompressed for exactly this purpose, and EPUB borrowed the rule. A .odt somebody renamed is still a .odt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

An unrecognised extension fell through unwrap_or("rust"), so naming a .css or .html file explicitly parsed it as Rust and rewrote it, at exit zero and with no warning. The Rust lexer reads the opening quote of 'Oxanium' as a lifetime, so font names gained a trailing space and the urls around them were broken apart. A directory walk skipped those files already; only an explicit path reached this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

The annealer was deleting comments and reporting success. A six-comment probe came back with two: a trailing comment on a match arm was moved onto the next arm, where it silently came to describe different code, and comments before a closing brace, above a doc comment, and at the end of a file were dropped outright. Trailing comments are the house idiom, so this hit exactly what CLAUDE.md asks people to write. The token stream survived every time, which is why nothing caught it: plain comments are trivia hanging off the following token, and the semantic test's sig() compared tokens alone. It guaranteed what it measured and no more. sig() now lifts comments into the compared sequence, which turned a passing test into 282 failing files. Comments are carried through each scan that stops at a closing delimiter and does not keep it -- fn bodies, struct fields, enum variants, match arms -- and across the parse, which reads EOF as a stop condition and so never sees a comment on the last line. A comment written after a field's comma belongs to the field it follows, not to the one the lexer attached it to. A body carrying a comment can no longer be collapsed onto one line, because the flat path emits no trivia. Where a layout path still cannot carry a comment, format_rust now compares the comments in its own output against the input and returns an error. Twenty-two files decline rather than lose a line. Declining is a worse formatter and a better tool. Two other corruptions found while testing. Byte and C string literals were split from their prefix -- b"ORE1" became b "ORE1", br#".."# became br #".."# -- which does not compile, and there are 674 of them across 53 files in ore, sbj, steel and datime alone. And four slashes were read as a doc comment, so a //// line moved onto the item below it. Alignment was measured as sum(len) + n - 1, a phantom space per token gap the renderer never emits, so any match whose patterns differ in token count came out crooked: Some(v) is seven columns, not ten. The CLAUDE.md example only looked right because its arms all have the same token count. Widths are now measured as the renderer will emit them. Output also gains the trailing newline every file should end with. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WD9whjGQMVeZXPJnJhvJmS

written by Jason Hoogland <hoogland@gmail.com>

The check for an off-site destination looked for a leading "//" and let "\\evil.example/x" through. The URL standard's relative states treat a backslash as a solidus for every special scheme, so a browser on an https page follows it off-site exactly as it follows "//": the allowlist was reading a different grammar from the one that resolves the link. The cleaned string now maps backslash to solidus before the test, so "\/host", "/\host" and a tab-prefixed variant go the same way, while C:\Windows stays refused and ordinary relative paths still pass. Found while making a forge render a README somebody else wrote, which is the first time this crate's policy stood between a stranger's prose and a page served under our own name. retarget comes with it, for the same caller and the same reason: a site publishing prose it did not write has to send every destination through its own judgement, and dropping a link while keeping its words is what the policy already does for a scheme it refuses. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

A neutral spreadsheet -- Book, Sheet, Cell, Value, and the A1 addressing a person types -- with a SpreadsheetML reader and writer over it. THE STORED VALUE IS THE VALUE. A formula cell holds two things, the formula and what the last calculation left beside it, and nothing here recomputes the second. That is the correct answer twice over: the stored value is the number the person who wrote the file SAW, and recalculating would break byte-identity the moment a volatile function is present -- NOW, TODAY, RAND, RANDBETWEEN -- so a file opened and saved with no edit would differ from itself and the check that exists to catch a damaging edit would fire on a healthy one instead. A gate that cries wolf is a gate somebody turns off. Three things about this format are traps and each is the kind of wrong that looks right. A shared string is an INDEX, so a reader that takes the cell at face value returns small integers where the names were. A date is a number and the only thing making it a date is the number format its style points at, through two hops, and it is usually a format the author defined rather than a built-in. And a cell is not where its position says: rows and cells are sparse and carry their own addresses, so a reader that pushes onto the end of a row puts everything after a gap one column out. All three are proved RED against the fixture: Number(0.0) where Text("Region") should be, Number(46095.0) where Date("2026-03-14") should be, and SUM(D2:D3) landing in the wrong column. The fixture is LibreOffice's own output -- it was handed a spreadsheet this crate wrote and asked to save its own -- so the intent is known and every byte of the encoding is somebody else's. It carries a custom numFmt of `General` alongside the date one, which is exactly the case that catches a reader guessing from format ids. The ceiling is stated rather than streamed past, and the reason is written down: streaming would need a second XML reader of the kind that hands over events rather than a tree, and the tree is what the editing path needs for its spans. One reader that refuses honestly above a stated ceiling beats two that disagree about what a document says. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

The counting was tested on a hand-made Reading, which proves the sentence and not the seeing. This reads a .docx LibreOffice wrote with a picture in it and checks all three things at once: the drawing is counted as one image, the prose BEFORE it is there, and the prose AFTER it is there -- a reader that stopped at the drawing would report exactly one image and lose half the document. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

A revert is written by the tool today and will be offered by the forge, and two tables of what an inverse is are two tables that can disagree about a history they both write into. So the inverse table, the refusals and their sentences, and the anchor a restoring copy binds by all live here. The anchor is the load-bearing one. A copy binds after the last byte of what it restores, and that convention is what lets `who` read the link back from a restored run to whoever first wrote it. Spelled any other way by any other caller, attribution stops working while both sides round-trip against themselves. The final arm of `undoing` is an error rather than a default, so an operation added later fails loudly instead of being quietly undoable by nothing. FromStr for OpId because an identifier is the one thing in this vocabulary a person types, and a reader written per caller accepts a different set of spellings per caller. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

Two tests for one claim, at the two levels it has to hold at. In the payload: setting `code` changes the bytes the address is taken over, and the tampered bytes are refused on the way in. In the artefact: a signed share of data alone, with the bit set afterwards by whatever carried it, fails at the address -- so a relay that wanted to add a consent claim would have to forge a signature to go with it. Both are built by hand rather than through `encode`, because what they need is a payload the schema refuses to WRITE: a `code` that disagrees with the files. A carrier is not held to the schema, so a test of what a carrier can do must not be either. Proved red first. Removing the address check fails the artefact half; writing the bit as a constant fails the payload half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

The reader does not enumerate element names, because counting them gets the problem wrong: across a real corpus the thirty commonest names cover 92% of the content and ZERO of the documents, since what breaks a reader is the structural singletons that appear once each in every file. So elements fall into four sets, and the fourth is the one that works -- handled, dropped, counted-and-not-drawn, and DESCENDED THROUGH. A content control, a smart tag, a custom XML block and everything invented since this was written contribute nothing themselves and their content is read where they stood. Same move the HTML reader makes, same reason. It reads the document's own vocabulary rather than Word's spelling of it. A paragraph is a heading because its style RESOLVES to a built-in heading name; a list is numbered because numbering.xml says its level's format is not `bullet`, through the two hops numId -> abstractNumId -> lvl. The fixture proves why both matter: LibreOffice gives its `Heading1` style no outline level at all, and calls its quotation style `BlockQuotation`. A reader written against Word alone loses the title of that document entirely, which is what the red run showed. What cannot be drawn is counted BY KIND and handed back -- "4 things are not drawn: 3 text boxes, 1 chart". A picture, a chart, a diagram and a text box are four different absences and calling them all an image tells a reader looking for the chart that there isn't one. A macro project is SAID, never run, and travels with the file untouched. Tracked changes are displayed as the document stands: an insertion's text is in the document so it is read, a deletion's is not so it is not. Nothing here authors either. The fixture is a .docx LibreOffice wrote from HTML whose content we chose: the intent is ours and the bytes are somebody else's, which is the only useful shape for a reader test. A round-trip test sits beside it and is weaker evidence on purpose -- and earned its place anyway, by catching a broken numId indirection the foreign fixture cannot see, because LibreOffice happens to number its abstracts to match. Also `doc::markdown::write`, the tree back out as Markdown, which is what a model wants to read a document as. Its nesting is the width of the marker above it rather than a fixed depth that compounded at every level, and its escaping goes where a character would change meaning and nowhere else -- a price in a table cell is not the start of a line. And the vacuous check in the XML suite now says so in its own words, naming the span-tiling property as the one with teeth, so a future reader cannot take it for proof of what it cannot prove. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

`daimond/share/0`, the third payload schema this container carries. It sends the files of one Diamond to one person, sealed to their key, and what lands is theirs: they may change it, the sender never sees the change, and there is no content key that outlives an edit, nothing to revoke, and nobody's storage in question but the receiver's own. The field that is not obvious is `code`. A shared Diamond carrying a page is carrying a program written by another person, and the receiver decides whether to run it -- so the artefact says, in the part the author signed, whether there is anything to decide. It is required and written even when false, because an omitted false and a sender whose build had never heard of the field are the same bytes, and those are the two things a receiver must be able to tell apart. And it is checked against the files both ways: a page under `code: false` is refused so the bit cannot hide a program, and a claim with no code behind it is refused so nobody is taught that the question does not mean anything. That check is what stops the bit being redundant with the files it describes. The claim is the SENDER's reading of the suffix set, pinned at signing time, so a later build that learns of a suffix this one does not know disagrees with an old artefact instead of quietly deciding for the receiver. Three paths are refused in the format rather than left to a client: `.daimond/`, which is the sender's own agent log and sync stamps; `versions/`, which is their history; and `capp.json`, a delivery record that never happened to the receiver and which, carried across, would pin their copy against updates they never chose. A copy arriving without one is a case the receiving client already knows. Two canonicalisation rules do work here that they do not do for a message. The files are ordered by path and a duplicate is refused, because a set of files written two ways would be one Diamond at two addresses. And a path is refused rather than normalised -- which is where this parts company with the client-side guard it otherwise matches, since that one tidies an untrusted request on the way to a real file and this decides what a signed artefact means. Ten fixtures, and every fixture already committed is byte for byte the file it was: the schema reaches the signing input length-prefixed, so a third name coming to exist re-addressed nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

A writer from the neutral document tree to WordprocessingML: headings, paragraphs, emphasis, links, lists nested nine deep, quotations, tables with a repeating header row, listings and thematic breaks. Six parts, of which four are what a .docx cannot open without. Everything is NAMED rather than drawn. A heading is Word's own heading style, so its navigation pane and a generated contents page both find it; a bold run at 20 point would look the same and be neither. A list is a numbering reference, not a bullet typed into the text. A link is a relationship the body names by id, and the test checks that every id the body names is one the rels part declares -- the one place a created document can be inconsistent while every part is well formed alone. Checked against LibreOffice, which is somebody else's implementation and therefore the only evidence worth having here: it recovers both heading levels as outline levels, the link's target, the nested bullets, the numbered list, the table's alignments and the listing's indentation. dev/docx_oracle.sh is that check, kept. The alignments settle a question rather than assume one: the document tree names the sides Start and End because it does not know which way its text runs, OOXML has the same two words for the same reason, and LibreOffice reads them as left and right. Nothing here decides what "left" means. An image is the one thing the tree can hold that this cannot carry -- the tree holds where an image IS, and there is no filesystem here. The alt text stands in its place and the omission is COUNTED and handed back to the caller, so a reader is told rather than left to notice. Placement, which is not where it was planned: `office` belongs beside the document tree in fe2o3_text and cannot go there. fe2o3_jdat depends on fe2o3_text, so fe2o3_text can depend on nothing that depends on fe2o3_jdat, and the archive does through fe2o3_data. This crate is on the other side of that line and can use both, so its remit widens to name archives and the document formats built on them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

A namespace-aware reader whose every node retains the byte span it was read from, and an editing model that splices into those spans rather than serialising a tree back out. Nothing is ever written out of the tree: an element with no handler is still a node and renders as its own bytes, so a document nobody edited renders as the bytes it was parsed from, not because that was tested but because no code path could do otherwise. What is tested is the property that makes it true -- the spans TILE the source exactly, every node's bytes in order giving the source back with nothing lost between two nodes and nothing counted twice. A reader that dropped comments, as readers do, fails there and nowhere else. Stricter than the HTML reader next door, because these documents are generator output: a mismatched close tag, an element left open, a bare attribute and an unbound prefix are all refused by name. A tag's end is found by parsing its attributes, since `>` is legal inside a value. This is not `doc`, and `doc`'s own policy says why: a tree that cannot carry markup it has no node for is right for reading and for creating, and wrong for editing a file somebody else wrote. Said in the module docs, because the next person will reach for it. fe2o3_net's UPnP client hand-rolls element_body() and first_element() over strings today, and is the second caller waiting for this. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

An in-memory archive over bytes, target-neutral, with one property the ordinary archive library does not offer: a member nobody touched is written back byte for byte. Its local header, extra fields, stored DEFLATE stream, data descriptor and directory entry are all the bytes that were read, so the theme, the custom XML and the tracked changes in somebody's .docx survive an edit to one paragraph of it. Reading takes the directory only, so opening a large archive to look at one small part costs the directory. ZIP64 is read and refused on write by name, rather than written back without its records. Encryption, split archives and unknown compression methods are named refusals; an unknown method still copies through. flate2 supplies DEFLATE and the CRC-32, so neither is hand-rolled here, and fe2o3_data comes in with default features off -- rayon does not build for wasm32 and a browser reads these archives. Tested against archives from two foreign writers, Info-ZIP and LibreOffice, both round-tripping byte for byte. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

Three things recognise the convention -- ore back, the exporter deciding what deserves a tag, and the forge's own listing -- in two crates that cannot see each other's copy. Each could disagree, and a rule implemented twice is the seam this project has paid for before. The predicate goes up and the generator stays down. Nothing but a tool authoring an operation ever produces one of these names, so the generator has no second implementation to drift from, and moving it would put a calendar inside a crate whose stated property is that it holds no clock. The two halves are held together by an assertion across the boundary instead: every name the tool makes must satisfy the rule read from here. It takes a name and not an operation, so a caller holding only something somebody typed can ask. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

A note about nothing is a mark with extra spelling, and so is a revert of nothing; the rule is Op::check_note's and this follows it, down to the error tag, because it is the same kind of fault rather than an ordering one. A test that let the empty list be refused for being out of order would send an author looking for a sort bug. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

Five codes above the eight, so this is the version 3 event again rather than a new kind of one: a version 2 segment still means what it meant, VERSION_MIN does not move, and no store owes a migration. A mark keeps one variant and gains two spellings. Where it carries neither a body nor a time it encodes at code 4 in two elements, byte for byte what was written before; where it carries either it encodes at code 9 in four. The encoding is a function of the content rather than of the author, because a mark that could be spelled two ways is a mark whose signature verifies two different things. A code 9 mark carrying neither is refused on decode for that reason. The time is seconds since the epoch and optional, which is the truth rather than a courtesy: a mark written before the log had a clock has no time, and the mirror's own sidecar remains the honest answer for those. The engine still reads no clock. The caller supplies one. Proposal, Said and Settled put the forge's backlog where every replica holding the repository holds it too, ballots excepted. Reverts says what a set of operations undoes, so a revert reaching somebody else's machine is not an unexplained deletion by a stranger. All six are about the history and not about the bytes: they claim no byte, mint no atom and render nothing, which the sequence already handles by the arm it takes for a mark. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015aBKK2qkMWh5qa1XxBnvSG

written by Jason Hoogland <hoogland@gmail.com>

Sharing a Diamond is coming, and the shape has to be settled before the first real message exists rather than after. The obvious-looking place for it is a fifth arm on post's Target, beside proposal, build, panel and guide. It is the wrong place three times over, and the third is decisive. A share CARRIES what it sends: the thing shared is a copy the receiver comes to own, and a reference is a pointer with a fallback sentence. A share is PRIVATE, and Target's own documentation says private device-local pointers are deliberately absent, because the other party cannot dereference one and an interface must never draw a chip that will always fail. And a share must carry a consent bit the signature covers -- a receiver deciding whether to run somebody else's code can only decide honestly if they can check the SENDER marked it, and a flag a relay could add or strip is not a flag. A Reference carries exactly two keys and refuses a third, so there is nowhere to put it. The first two arguments might be argued around; that one cannot. So SCHEMA_SHARE is reserved as a name, with the reasoning beside it. Nothing constructs or reads one, and an artefact declaring it is refused saying so, which is the right answer from a reader that does not implement it. Reserving it costs nothing already signed. The schema reaches the signing input length-prefixed, so a third name cannot change how a post signed under the first two is read. That is now a test rather than a claim -- and the test says what it does not prove as carefully as what it does. It does not exhibit a collision: in v0 the schema and the hash are not adjacent, and a schema is a String while the scheme id between them begins 0xF5, which is not valid UTF-8. The ambiguity is unreachable by accident of the constants, and the prefix is what makes it unreachable by design. The other property a later fifth arm would depend on is pinned too: an unknown reference kind is refused, by name, and the message carrying it is refused whole rather than arriving with one reference fewer than its author signed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

Left over from the lift: `-p sbj` names no package in this workspace. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

Eleven of them: four a reader must accept, seven it must refuse. Between them they cover each of the four things a message may point at, a body past its ceiling, a nonce of the wrong width, a sealing subkey of the wrong width, a list that is present and empty, a duplicate key that survives only in the bytes, a non-minimal length in the envelope, and the re-labelling the length prefix of §1.3 closes. Meta's node count and depth become optional. A post and a card have neither, and a fixture declaring zero of each would be asserting a measurement of a shape it does not have. The document compiler is excluded from the four record fixtures by an assertion rather than by a skip: it is required to REFUSE to write one. A fixture passed over in silence is a fixture that could stop being run without anybody noticing. The existing forty-six are byte-identical, every file, checked against a copy taken before any of this: no document's address moved and no expected rejection was rewritten to suit the code. README.md alone changed, to say `-p oxedyne_fe2o3_sbj` where it still said `-p sbj`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

The container has carried two record schemas since the post and the card arrived, and nothing in the crate could write or read a file holding either: every route ran through the node-tree validator, which admits the three oxeweb names and refuses the rest. Payload is where a schema name now chooses a validator. A tree is walked, a post and a card are checked by their own field rules, and the enum is exhaustive, so a sixth schema cannot arrive without the compiler naming the places that must learn it. Schema itself is left alone: its job is to fix a vocabulary of node kinds and of style properties, and a record has neither. seal and assemble become public, and envelope_for joins them: the half of sealing that holds no key material, so a signer living where this code cannot reach -- a browser's non-extractable key -- can take a signing input away, sign it, and hand the signature back. An artefact assembled before the signature arrives is refused at step 5 saying exactly that, rather than by a signature library that has never heard of this format. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNNMfaiBG6s6KNVUryzBKZ

written by Jason Hoogland <hoogland@gmail.com>

`{env:VAR}` and `{file:path}` expansion lived inside fe2o3_steel's route configuration, so the Oregami forge reimplemented it. It is generic -- a string, a root directory, and a daticle walk over the two -- and belongs beside the format it is expanding. Two differences between the copies were resolved rather than picked from. An unclosed placeholder now quotes the value as it was written rather than the half-expanded intermediate, because an author should see what they typed. And the wording is the house voice rather than steel's `Config:` prefix, which means nothing in a shared crate. fe2o3_steel still carries its own copy; the delegate that would remove it is not made here, because that file has another session's worktree open on it.

written by Jason Hoogland <hoogland@gmail.com>

The comments added with the claim described garbage collection as renaming over a live file and orphaning another handle, and offered that as the hazard the claim protects against. Both halves were wrong, and the second was not even the claim's business. Collection rewrites archived files -- the ones sealed when they passed their size limit -- and no writer holds one open. The passage in `bot_initgc` that warns about a rename replacing an inode under a writer's handle is the reason the init-time index rebuild writes *in place* rather than renaming, which is the opposite of what it was read as saying. Ozone separates by ownership throughout: writers are handed their own live pair by the zone survey, collectors work on archived files, and the bots are per zone. What the claim is actually for is narrower and worth keeping. The counter is seeded from the highest number the survey found, which is what makes it correct; before that fix, reissuing a number in use destroyed the sealed file's record state at every rollover. Creating the file is atomic, so a number that is taken cannot be handed out however the counter came by it -- unconstructible rather than avoided. It also makes a zone written by two processes safe, each having seeded from the same disk.

written by Jason Hoogland <hoogland@gmail.com>

An earlier commit added a holder file refusing a store a second process had open. The diagnosis behind it was wrong and this replaces it. Records do not interleave. Data files are opened for append, so the kernel places every record whole at the end whoever is writing. What was actually broken is narrower: the offset written into the index comes from a length cached in the process, and a zone bot handed out live file numbers by incrementing its own counter. Two processes therefore named the same file and each placed records at offsets predicted from its own cache, so the bytes were sound and the index entries named positions inside each other's records. `rollover.rs` already describes the same fault arising within one process, where a reused number costs a whole FileState. A number is now claimed by creating its files with `create_new`, which is atomic, so of two writers racing for one exactly one wins and the loser is told at once. A writer is then the only appender to its own live file, which is what makes the cached length stay true. Numbers are no longer contiguous where a zone is written by more than one process, and nothing depends on that: a zone's files are found by reading the directory. So concurrent writing needs no exclusion, which is the design this database was built to have. What remains genuinely conflicting is garbage collection, the one operation here that is not an append: it renames a rebuilt file over a live one and orphans another handle's inode. It is opt in, so it is settled by deciding which process compacts rather than by refusing to open.

written by Jason Hoogland <hoogland@gmail.com>

Two processes opening one store both write into the live file of each zone, interleaving records and losing each other's, and neither is told: the appends go through separate handles at separate offsets and each keeps its own index. Nothing in the database could make that safe, since the two share no channel to co-ordinate over. What it can do is refuse the second one at the moment it opens rather than at the moment it corrupts. A `holder` file in the store root carries the holding process's identifier, created with `create_new` so two processes racing a fresh store cannot both win. It is claimed before the configuration file is written, which is the first write, so a process turned away has changed nothing. An existing claim is checked rather than obeyed. A process that is killed leaves its holder behind, and a store nobody can reopen without deleting a file by hand would be worse than no guard: a holder that is gone is taken over, and only a live one refuses. The refusal separates the two readings, because they want opposite actions and the reader may be somewhere unhelpful at the time. Either the named process is the holder, and stopping it is the answer; or an identifier was reused after a hard kill, and removing the file is. It says which file, and says where to look to tell them apart. Found because a downstream application had begun inventing its own guard. The gap was the library's, so the fix is.

written by Jason Hoogland <hoogland@gmail.com>

Verification is 45% of a forge page on the fe2o3 import -- 390 ms of 860, at 38 microseconds a signature over 10,183 operations -- and a replay verifies every operation it reads. Two changes, neither of which alters what the system accepts. `Signer` gains `verify_batch`, defaulting to a loop so every implementor is correct unchanged, and `SignatureScheme` overrides it for Ed25519. Dilithium takes the default. The doc comment carries the contract that matters: a batch says the set does not hold and cannot say which member failed, so a caller owing the reader the name of the failing operation must fall back to verifying singly. `Store::replay` and `check_incoming` do exactly that, and refuse anyway if the fallback finds nothing rather than accepting a set the batch rejected. The decompressed verifying key is cached per signer within a batch, which is the larger win here and does not depend on the batch equation at all: a history signed by one key decompressed it once per operation. Dalek's batch equation decompresses R where its single check compares bytes, so a non-canonically encoded signature would pass the batch and fail singly. That is malleability rather than forgery, but it is a widening, so `is_canonical_point` rejects the encodings that differ and the two predicates accept the same set. The wasm32 guarantee holds: 2.x derives its challenges from a merlin transcript over the inputs, with no OS randomness on the path. Checked for both the engine and the scheme with the feature on.

written by Jason Hoogland <hoogland@gmail.com>

`daimond/card/0` is the third schema and the second that is not a tree. A card is what a QR code carries and what a paste carries; a bare public key is not, because it cannot say which key signs and which seals, carries no label, and gives a reader no way to tell a first key from one that replaced another. Most of a card is the envelope's already, which is the argument for putting it here: the signing key is `author`, the signature is `sig`, the algorithm is `sig_scheme`, the creation time is `time`. What is left is what a key cannot say about itself -- `label`, `enc`, `role`, `prev` -- and that is all this schema defines. Self-signed is stated plainly in the module doc because it is the thing most easily over-read: a card verifies under the key it carries, so it proves the holder of that key composed it, and proves nothing whatever about who that holder is. A card fetched from a server verifies perfectly and is still Unverified, because an intermediary that substituted its own key would produce one that verifies just as well. `prev` is signed by the NEW key only, so it is a claim of succession and never a proof of one -- otherwise anybody could claim to supersede anybody. `fingerprint` and `safety_number` are here so that there is ONE implementation of each. The plan records that `Account` already serves a fingerprint and the design specifies another, and that these must be the same function or one must go; two renderings that eventually disagree on some untested key would show a user their correspondent's key appearing to change. The fingerprint decides nothing and says so twice: equality is always the full 32 bytes, and eighty bits is well within reach of somebody who wants two keys to look alike in a list. The safety number is the whole digest and never a prefix, because the attack is a meet-in-the-middle at 2^(n/2) and halving the width quarters the exponent. Crockford base 32 goes in `fe2o3_text::base2x` rather than here, because `Base2x<32, 5>` already exists and Crockford is an alphabet rather than a codec. Reaching for the generic thing that was already built is the whole point of the preference order. Twelve tests. The fingerprint's alphabet is restated in the test rather than read from the constant, so the check is not the code agreeing with itself.

written by Jason Hoogland <hoogland@gmail.com>

`daimond/post/0` is the first payload here that is not a node tree. A document is a tree because a document is one; a message is a record of five fields, so the payload is a single canonical map and §4 does not apply to it. The envelope, canon, the limits and the verification order are untouched, which is the claim SBJ has been making about itself since it was written down. What the payload carries: `body`, `to`, `nonce`, and optionally `reply_to` and `refs`. What it deliberately does not carry is as load-bearing. There is no `from` -- the author is the envelope's, so there is no second place to say who wrote it and no spoofable name to disagree with the key. There is no `created` -- a timestamp is advisory and belongs to the envelope, and a payload asserting its own clock would be asserting one nobody can check. A reference carries no sender-supplied title, only the referent and a fallback the reader draws on failure: a title is stale the moment a proposal is renamed, and it is arbitrary sender text drawn as though it were a forge record. `body` is a BU32 and a BU8 is refused by name, since a BU8 truncates silently past 255 bytes -- a defect that surfaces the first time somebody writes a long message. It is carried as bytes, so `canon`'s string rules do not reach it and this schema applies them itself: without that, one text could have two encodings and so two addresses, which is the whole of §3 rule 5. References are an enum over four PUBLIC anchors -- proposal, build, panel, guide. A private, device-local pointer is refused by name and says why: the other party cannot resolve one, and an interface must never draw a chip that always fails. The target is a map with exactly one entry, the same rule and the same reason as a link address in §4.3. Twenty-five tests, and the negative ones were proved red rather than assumed: removing the empty-list guard reddens exactly `test_empty_refs_list_refused`, and removing the text check reddens exactly the three body-text tests, with the other twenty-one staying green. A rejection test that passes for any error is a test that cannot tell "rejected" from "rejected for the right reason".

written by Jason Hoogland <hoogland@gmail.com>

`sbj` was written in the oxegen tree against seven fe2o3 crates by path, which made it a downstream application of a library it is really a part of: a signed binary envelope over BDAT is serialisation, and serialisation is this workspace's business. It sits above `crypto` and `hash` and below `steel`, and every one of its dependencies -- core, text, jdat, crypto, hash, iop_crypto, iop_hash -- is already beneath it, so the layering needed nothing invented for it. Lifted whole rather than reimplemented, which is the point: `canon.rs` already enforces every byte-level rule by re-encoding what it decoded and demanding the same bytes back, SPEC.md is normative, and the 46 conformance fixtures are the format's teeth. A second encoder written here would have been a second answer to a question that already has one. The four oxegen crates that used it -- kiln, oxeye-core, oxeye, sbj_wasm -- now depend on `oxedyne_fe2o3_sbj` across the tree boundary, and `oxegen/sbj` is deleted rather than left as a copy to drift. Tests move with it and pass here: 159 lib, 4 CLI, the conformance suite over all 46 fixtures, 3 doc tests.

written by Jason Hoogland <hoogland@gmail.com>

A zone whose index file was empty recovered by rebuilding it -- and the rebuild renamed a fresh file over the index, REPLACING THE INODE underneath the write bot's already-open append handle. The bot went on writing, into a file nothing would ever open again. Every index record for the rest of the process was lost. The data file is never renamed, so get() stayed perfect and only scan went blind: a zone that held records answered as though it held none. Self-perpetuating, since every restart rebuilt, detached, and lost that run's writes again. Seen in a store from 2026-08-14: zone_001's index 0 bytes, its data file 5805, holding records that had been successfully read by key during the same run. The mtimes say it exactly -- the index last touched at the rename, the data file sixteen seconds later by writes that never reached it. The rebuild was added on 12 August to repair this state; it was causing it. The rebuilt index is now written into the existing inode, so the open handle stays valid and the bot's writes land after the rebuilt records. Atomicity is traded away on purpose: renaming GUARANTEES loss, while in place risks a partial index only if the process dies inside one write of an in-memory buffer -- and a partial index is caught by the size check on the next start and rebuilt. Collection keeps its rename, which is correct there: no writer holds a collected file open, and concurrent scanners do. A scan can now report a shortfall rather than answering with silence. The check is exact rather than heuristic -- each index record carries klen + vlen, so one index file's records sum to its data file's length. Each data file is measured on BOTH sides of its own walk and the smaller used: a collection only shrinks and an append only grows, so the smaller is under the coverage in both races. Measuring up front instead would have false-flagged nearly every walk under a collection backlog. Proved red: restoring the rename fails the new integration test, which asserts that after recovery a single write makes the index file ON DISK grow -- an assertion that never touches the scan, so fixing the scan cannot satisfy it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VNerD7Ht6YcrWgPPcZnykm

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VNerD7Ht6YcrWgPPcZnykm A caller's own X-Forwarded-For was copied through and this hop's value appended after it, so a request arrived carrying two. HeaderFields::get_one returns the FIRST, which is the caller's -- so anything keyed on it grants a fresh allowance per invented address, which is no limit at all. A downstream forge found this the hard way and reads the last value to defend itself. Now: a caller's copies of x-forwarded-for, -proto, -host and forwarded are dropped unless the peer is a configured trusted proxy, and this hop appends its own. THIS HOP'S VALUE IS LAST UNDER EITHER POLICY -- one value when the peer is untrusted, the caller's chain preserved and ours appended when it is trusted -- so a reader taking the last value is correct by construction rather than by arithmetic over a list an attacker contributed to. Asserted in both branches, by putting the built head back through the wire parser rather than scanning a string, so what is asserted is what a reader receives. Stripping unconditionally would be wrong the day anything sits behind a CDN: the real client address would be discarded and every visitor replaced by the CDN's egress. Hence trusted_proxies, parsed at start-up so a typo is a start-up failure rather than a silently empty allow-list. HeaderFields::get_last is new and is half the fix. Its absence is why get_one was reached for. Its doc says when each is right -- get_one for a field whose sender is its authority, get_last for every field a proxy chain appends to -- and records that a value here is one LINE, so 'a, b' is one value and not two. Trusted-proxy policy and hop-header hygiene are generic HTTP, so they live in fe2o3_net::http::fwd; fe2o3_steel keeps only its trusted_proxies config. The tests that drive Steel end to end stayed with Steel, because they answer the one question the library tests cannot: whether Steel calls the lifted code at all. 40 tests. Proved red: a policy that trusts every peer reddens three, the either-policy invariant among them.

written by Jason Hoogland <hoogland@gmail.com>

Three quarters of the films this serves are HEVC, so a repackager that handles only H.264 leaves most of the collection where it was. Both codings are carried in length-prefixed NAL units and both state their configuration in a record the source container already holds, so HEVC is a `Codec` variant and a sample entry of `hvc1` carrying the `hvcC` verbatim. Nothing is decoded and nothing is re-encoded, exactly as for AVC. The geometry comes out of the record rather than being trusted from the container: `hevc::config` gives the parameter sets and `hevc::sps` reads the coded size out of the sequence parameter set. Those already existed, so this adds no parser. The parameter sets come out of `hevc::config` already unescaped -- `Unit::body` is the RBSP and `Unit::raw` keeps the escaped form beside it -- so nothing is unescaped a second time, which would have produced a plausible wrong size rather than a failure. Two things were wrong before and are fixed here, neither of them about HEVC as such. A film's compressor name was the literal `AVC Coding`, written into every visual sample entry whatever the film was coded in; it is not a match, so it would have gone on saying AVC about HEVC for ever without a word. And the whole-file `ftyp` listed `avc1` among its compatible brands unconditionally, which on an HEVC film is a claim of conformance to a specification it does not conform to. `ftyp` now takes the codec: `avc1`, `hvc1`, or neither for a film that is only sound. ffmpeg agrees the distinction matters -- it drops `avc1` from a whole-file HEVC film and includes it for H.264. The fragmented `ftyp` is deliberately left alone at `iso5 iso6 mp41`. That list was measured from ffmpeg's own fragmented HEVC output, which adds no fourth brand; and a fragmented film may carry several streams, so a whole-file conformance claim taken from one of them would be wrong in general. Held to ffmpeg over real films: three HEVC features repackaged out of Matroska at 1920 by 1016, 800 and 816, every frame decoding and every picture shown where the source put it. The AVC and fragmented paths are unchanged and still green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bJSLj2Gez35A1DCpi98um

written by Jason Hoogland <hoogland@gmail.com>

`Track::finish` returns the whole file as one `Vec<u8>`, which is right for a poster and impossible for a film: a four-gigabyte repackaging would be built in memory before a byte of it could be served. And it writes one track, so a film made with it has no sound. Both wanted the same restructure, so both are here. A fragmented film states its timing per fragment rather than in one sample table, which means there is no `stco` to patch, no `stsc`, and no sample tables at all -- the `moov` carries empty ones and each `moof` describes its own run. Fragmenting is therefore SIMPLER than indexing several tracks, not harder, which is why this is a second writer beside `Track` rather than a change to it. `Track` is untouched; posters still want it. `Stream` carries a start time, and it is not decoration. A film's first sound frame is rarely on the same instant as its first picture, and a picture track shifted so that none of its composition offsets is negative has moved relative to sound that was not shifted with it. Without somewhere to say that, the two are nailed to a common zero and the film carries an offset between picture and sound that no caller can remove. The `trun` is version 1, so composition offsets are signed. ffmpeg writes version 0 and cannot express a negative one, so it compensates elsewhere: it inflates the first sound sample's duration from 1024 to 4864 -- exactly the video's 80 ms composition delay -- because with an empty `moov` it cannot know the delay in time to write an edit list. That is a workaround for a missing `elst`, not a thing to copy. The format was measured rather than recalled. A reference file was made with ffmpeg and taken apart box by box, and two of its choices are deliberately not followed: it writes `next_track_ID = 2` for two tracks, where the field must exceed every track id in use, and it sets `tfhd` defaults that this writer omits in favour of stating every value per sample, which is always correct and needs no defaulting. Held to ffmpeg over real films: both streams written across several fragments, every frame decoding without complaint, and each track's times read back and compared to what was handed to the writer. The fifth question is the one that earns the test: checks on each track separately each allow their own track one constant delay, so together they permit the two to be delayed by DIFFERENT amounts -- a film whose sound is out, which every earlier check passes happily. All three breaks were proved to reach their own check and no earlier one: a single picture offset moved one tick fires the picture comparison; one sound offset moved one tick fires the sound comparison; and a whole sound track delayed two hundred ticks -- internally perfect, one constant from its source, exactly what the sound check permits -- fires only the comparison of the two tracks against each other. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bJSLj2Gez35A1DCpi98um

written by Jason Hoogland <hoogland@gmail.com>

A film repackaged out of Matroska would not play, and the reason was that the writer could describe only a stream whose pictures are shown in the order they are decoded. Where B-pictures are used they are not: a picture is decoded before the ones it is shown between, so a container has to state both orders. `stts` gave the decoding times and nothing gave the difference. Nearly no film is such a stream. The one measured here has 41 B-pictures in its first 60, shown at 0, 160, 80, 40, 120 while decoded at 0, 40, 80, 120, 160. So `Sample` carries an offset, `ctts` is written when any of them is not nought, and `composition_offsets` works them out from the presentation times a source container states -- which is the form a film arrives in, because Matroska states only when a picture is shown and leaves the decoding order implicit in the order the frames come out. The offsets are all raised by one constant so that none is negative. A picture at the head of a reordered run is decoded early precisely so that the ones it is shown between can refer to it, so its raw difference is negative, and a negative offset says a picture is shown before it is decoded. Raising them all delays the whole film by a few frames and leaves every interval between pictures exactly as it was. An absent `ctts` is written for a stream that never reorders rather than a table of zeroes, because absence is what states that the two orders agree, and the table would cost four bytes a sample to say it again. Held to ffmpeg over real films, in three questions rather than one, because the first two both pass on a film that is wrong: ffprobe agrees the written film is h264 of the right size with the right packet count; ffmpeg decodes every frame without complaint; and **the presentation times are read back and held against the source's**, which may differ by one constant and not by two. Five films, 400 frames each, all three green. The third question is the one that earns its place, and it was proved so rather than assumed. Zeroing the offsets fails at the decode. Rotating them fails at the decode. But moving a single offset by one tick -- which is what an off-by-one in a run-length table looks like -- decodes cleanly, counts correctly, and is caught only by comparing the times: frame 17 shown at 721 where the source says 640. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bJSLj2Gez35A1DCpi98um

written by Jason Hoogland <hoogland@gmail.com>

The end-to-end claim the repackaging rests on is that a browser refuses an MKV for its container and not for its contents, so moving the same coded bytes into MP4 makes the film play. This asks that question of a real film and a second program, and the answer today is no. **The test is committed red, on this branch only, because it is red for the right reason and it is the check that will say when the gap is closed.** What it found: the MP4 writer cannot express B-frame reordering. Frames leave a Matroska cluster in decode order carrying presentation times, and MP4 states the two separately -- `stts` for decode durations and `ctts` for the difference. The writer has `stts` and `stss` and no `ctts` at all, so it can only describe a film whose pictures are shown in the order they are decoded. Nearly no real film is such a film. The one measured here is 41 B-frames in its first 60, and its packets carry presentation times of 0, 160, 80, 40, 120 against decode times of 0, 40, 80, 120 -- so writing the presentation times as though they were decode times produces exactly what ffmpeg reports: a decode time that goes backwards. Worth stating plainly against the earlier estimate, which held that repackaging needed no encoder work: that is still true, and it was not the whole cost. Composition offsets are muxer work, but they are more than the fragmented output already known about, and the caller must derive decode times itself -- Matroska stores only presentation times, so the reordering delay has to be recovered from the frames rather than read. The container half is checked before the decode half deliberately. ffprobe agrees the written film is h264 of the right size with the right number of packets, and it is wrong regardless: a container written badly still opens and still counts plausibly, and only asking a decoder to run through it says whether the bytes it was handed were the frames. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bJSLj2Gez35A1DCpi98um

written by Jason Hoogland <hoogland@gmail.com>

Reading the header says what a film is; repackaging it into a container a browser will play needs the frames themselves. This is the other half of the Matroska reader: the clusters, the blocks and the frames inside them, decoding nothing. What comes out is the codec's own bytes, unaltered, which is what makes a repackaging lossless and what makes it possible without a decoder at all. It is fed rather than handed the file. A film is gigabytes and the whole point of repackaging is to avoid the memory a decode would cost, so `Segment` and `Cluster` are descended into by consuming their headers alone and their children read as though they sat at the top. The window a caller holds is therefore one block -- a frame -- and never one cluster, which is megabytes, and never the film. Elements that are not wanted are passed over by their stated length without entering the window at all, so a film carrying cover art costs nothing to skip. The frames of a laced block are spaced by the block's own span divided among them, not by the frame duration multiplied up. The two differ because a timestamp unit cannot represent a frame of sound: AAC at 48 kHz lasts 21 1/3 milliseconds and eight of them are 170 2/3. Multiplying accumulates the third of a millisecond until the last frame of a block is stamped later than dividing says, and in the limit past the start of the block after it. Dividing keeps every frame inside the block that carries it. That fault was found by the oracle rather than by reasoning, and only because the comparison covers the sound. Lacing is an audio phenomenon -- a film's picture is one frame a block and exercises none of it -- so the first version of this test compared the picture alone, passed, and left the lacing arithmetic wholly unproven. Comparing `a:0` as well failed on the second frame of the first film: the sizes were right, every frame was there, and only the clock was wrong, which in a repackaged film is sound that walks away from the picture. Held against `ffprobe -show_packets` over real films, comparing each frame's size, presentation time and keyframe flag in order: 15,000 frames across five films, both streams of each, no disagreement. Proven red first by three deliberate breaks -- ignoring the cluster timestamp, calling every frame a keyframe, and reading the block header a byte early -- which the comparison caught at frames 76, 1 and 0 respectively. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012bJSLj2Gez35A1DCpi98um

written by Jason Hoogland <hoogland@gmail.com>

A film collection is written mostly in Matroska, and a catalogue that cannot open one under-reports what is on the disk. This reads the header and decodes nothing, as the AVI reader beside it does. It reports every track and not only the picture. The question a library asks of this reader is whether a browser will play the file, and that is settled by the sound as often as by the picture: AC-3 is common and no browser decodes it, so a reader that found the picture and stopped would call such a film playable. Held against ffprobe over 1,334 real films: 1,333 agreed on the size, the running time and every stream's codec, worst running-time difference 0 ms, none needing more than 64 KB of head. The odd one out is a dangling symbolic link. Thirteen more files the reader refuses are empty. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1bWBDWXyvFfT4vuP79dag

written by Jason Hoogland <hoogland@gmail.com>

`Dat::map_get_i64` and `map_get_f64` had no `u64` counterpart, though `Dat::get_u64` has existed all along. A caller reading a `Dat::U64` byte count through `map_get_i64` reinterprets the sign bit rather than erroring, which is the wrong answer rather than an answer refused.

written by Jason Hoogland <hoogland@gmail.com>

An index record is chash || key || cind || meta || csum || floc. StoredKey::load strips the four-byte cache hash off the front of what it returns; cache_data_file wrote those stripped bytes straight back. So after every collection, every record in the rebuilt index was four bytes short and the file was undecodable from its first byte. Nothing noticed for as long as this has existed, because the only reader was initialisation -- which catches the failure, warns, and quietly falls back to scanning the data file. Then scan arrived, with no fallback, and died on "Dat identification code 101 not recognised". That is the UpstreamErr the operator console has been showing for every view that scans, while single-key reads carried on working because they never open an index file. inc_index_file_size was under-counting by the same four bytes per record, so zone directory accounting drifted low after each collection. Both come from one line. The rebuild is now atomic. It used to delete the index and rewrite it in place, so for the length of a rebuild the file was absent and then partial -- already a hazard at the shipped default of two collectors per zone, where one could walk a file the other was mid-rebuild on and drop every key whose value lived there. It writes the .gc temporary and renames over the index in one step, so a reader sees the whole old file or the whole new one, and a crash leaves the old one intact. And scans no longer queue behind collection: they go to their own per-zone pool (num_scbots_per_zone, optional, default 1) rather than to the collector, whose loop runs collect_garbage and cache_file inline to completion. The reader bots were the cheaper home and were rejected -- a whole-zone walk ahead of a get makes every single-key read wait, and get currently works. The test builds the backlog with collection off, then switches it on and dispatches the lot before scanning. It fails on unmodified code every run. Its latency assertion is a tripwire against scans returning to a shared queue, not a proof: a collection touches one file and a scan touches all of them, so the coupling is bounded at about two whatever the store size, and the six-second timeout cannot be manufactured at any size a test can afford. The correctness half is the sharp half.

written by Jason Hoogland <hoogland@gmail.com>

An exhaustive config literal is a promise to update it whenever the defaults move, and nobody keeps that promise. Every value it currently uses is restated, so behaviour is unchanged. The 1500-byte chunking threshold and 64-byte chunk size are left alone with a note: Steel's own comment records them as inherited from the TEST setup, and changing them alters how values already in a Shield store were split.

written by Jason Hoogland <hoogland@gmail.com>

The accept loop had no way out. `Server::start` ended in a `loop` around `accept` with no break and nothing selected against it, so the "Server stopped gracefully" a few lines below it was unreachable in production and every deployed Steel was felled by `SIGKILL` with its Ozone instances still open. There was no `ExecStop` anywhere in the workspace either, so nothing asked it politely first. That is not a tidiness matter. A store killed mid-write leaves records short of their checksum, and a downstream library has spent this week recovering from exactly that. The loop now selects the stop against the accept -- both arms are cancel-safe, which is what makes the select legitimate -- returns the port before draining, and gives whatever is in flight `DRAIN_SECS` to finish. Five seconds, and a connection is counted while it is *open* rather than only while it is being answered, so a keep-alive and a WebSocket both hold the count up and a busy server usually waits the whole five. That is the price of not cutting off the one response that was mid-body, and it is well inside systemd's default ninety. Then every vhost's store is closed. One Ozone per vhost, not one per process, so the whole map is walked; a poisoned lock is recovered from rather than propagated, and a store that will not close does not stop the others. **A second fault only the first fix could reveal.** With the loop mended, the stop came all the way home, closed the database, said so, and then hung for ever one line from the end: in dev mode the file watcher is spawned onto the blocking pool and never returns, and dropping a runtime waits on that pool. `shutdown_timeout` rather than a drop. The listener goes in `app/tui.rs::run_with_extension` and not in `main.rs`, because `main.rs` is only the stock binary -- every app built on Steel as a library calls `run_with_extension` directly, and would have been left deaf to a reboot. It is installed after the logging is configured, so what it says on the way out is written down. A stop arriving when nothing is serving -- a one-shot command, the interactive shell -- flushes the log and leaves. Catching a signal and merely noting it would have made Steel start ignoring a `SIGTERM` it used to obey. The two process-level tests send a real `SIGINT` and a real `SIGTERM` to a real server and require an exit status rather than a signal, the port released, both shutdown lines, and a genuine reopen with a round trip -- a reopen alone proves little, since Ozone acknowledges every write and a killed store still reads. They wait for "database(s) open and attached" before signalling, so a sealed start cannot pass them while proving nothing. Both fail on the build before this with "it was felled by signal 15, which means it caught nothing". The drain was proved by breaking it: 30 MB at 10 MB/s, stopped one second in, gives a truncated body and a curl error at nought seconds and an identical file at five. The first attempt used 5 MB and passed at nought -- the whole body had gone into the socket buffer, so the check proved nothing. A transfer has to outrun the kernel buffers to have teeth.

written by Jason Hoogland <hoogland@gmail.com>

A long-running program is not asked to stop in words. It is sent a signal: `SIGINT` when somebody presses Ctrl-C, `SIGTERM` when a service manager or a reboot says to go. Nothing in this library heard either, so every program built on it was killed where it stood, and anything holding a store open was killed in the middle of a write. `fe2o3_core::stop::on_stop_request` takes a closure and calls it on every ask -- `SIGINT` and `SIGTERM` on unix, and on Windows the three console events. One listener to a process, because a signal arrives at a process rather than at an object, and a second call is refused rather than quietly stacking a second thread behind the first. **There is no `unsafe` in it, and that is the point.** Three of the four routes from a signal to a program need one -- `sigaction` and `SetConsoleCtrlHandler` are `extern "C"`, and `signal_hook_registry::register` is an `unsafe fn` because whatever it registers runs in signal context. The fourth is tokio's `signal` module, whose whole public surface is safe: the registration and the signal-context work sit inside tokio, and what reaches the caller is an ordinary stream read on an ordinary thread. So this crate keeps `#![forbid(unsafe_code)]` and so does everything downstream of it. It also means the closure is under none of the restrictions a signal handler is under: it may allocate, lock, log and take as long as it likes. The dependency is declared for every target but `wasm32`, mirroring the wasm block already in the file: there are no signals in a browser, and the feature pulls in `mio`, `libc` and `signal-hook-registry`. Checked rather than assumed -- `cargo tree` shows those three on native and tokio alone on wasm32, the wasm build passes, and the Windows arm compiles under `x86_64-pc-windows-gnu` rather than merely looking plausible. Nothing here can be proven from inside a test binary: a test cannot send itself a signal and go on being a test. The claim that a real signal reaches a real program belongs to whoever has a program to stop, and the first caller proves it with four process-level tests.

written by Jason Hoogland <hoogland@gmail.com>

The take-over button works by handing the save to the composer's autosave, and the dump carried only the author row -- so it proved the control drew and nothing about whether pressing it wrote anything. It now renders the fields that autosave needs and both scripts, which makes the handover between them something a browser can be pointed at. Driving it: click, one POST to the save endpoint, `author=` empty, which is what the handler reads as "attribute this to whoever is signed in". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

The take-over control shipped into the field row, where it inherited `flex:1 1 8rem` alongside five fields and was crushed into a column two words wide: the label wrapped onto two lines and "Write as me" wrapped onto three inside it. The user could not find a button that was on the screen, which is a fair description of it not being there. It is a note about the post rather than a field of it, so it takes a line of its own at the foot of the row, centred, with the label and the button held to one line each. The render that missed this drew the row in isolation. The dump now builds the same field row the composer builds, so what is photographed is the geometry a person actually meets -- which is the whole point of photographing it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

It went to the card's foot because at 48px it appeared to tower over the head's line of small meta text. The size was never the fault: blog.css sets a card's meta line to `align-items: baseline`, at a specificity the site's own mark rules could not beat, so the mark sat ON the text baseline and stuck up above the line. The full post was never affected -- its line is a different element, already centred. So the mark goes back beside the reading time, and the two surfaces show the same facts in the same order. A reader moving from the list to the piece is not asked to look somewhere new. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

**A post could not be re-attributed.** It carries the username of whoever saved it, the editor posts that back in a hidden field, and nothing in the console could change it -- so a post written under an earlier identity (an import, a member account since retired, a renamed operator entry) had a byline reading Anonymous for ever, pointing at a name that has no profile and no way to acquire one. The editor now offers "Write as me" where the author is somebody else, and offers nothing where it is already yours. Clearing the field is the whole mechanism: the save handler attributes a post naming no author to whoever is signed in, so the control empties the input and lets the ordinary autosave run. The event is dispatched by hand because setting a value in script fires none -- the same reason the chip scripts dispatch one. **A card's mark moves to its foot, right of Read more.** At the size a level has to be drawn to be countable it towered over the card's line of small meta text, which is where it was. The foot already carries something the size of a control. A post's own mark stays with its reading time, where the line has the room. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

Three faults, one of them losing data. **The composer never got the level back.** `post.json` did not carry `ai_level`, so the app's editor opened every post reading "Not declared" and the next autosave wrote that back -- taking a declaration its author had made. The field a form writes must be a field the form is given. **The mark sat in the wrong place.** It had a row of its own above the prose, which made it a heading rather than a fact about the piece. It now sits in the meta line, immediately right of the reading time, where a reader is already being told what the piece is before deciding to read it. No words there: they would repeat on every card in the list, and the mark is drawn large enough to be read without them. **The site's own declaration was on every page of the blog.** It says something about the whole site, so it belongs in the site's own footer and is said once; under every post it was the same sentence on every page a reader opened. The configured declaration is still served -- the front page draws it from `declare.json` -- it is simply not drawn here. One size, `MARK_SIZE_PX` = 48, wherever this module draws a mark. The scheme's floor of 40 is where a level stops being countable at all, which is a bad place to sit: it leaves nothing for a cheap screen, a low zoom, or a reader not looking closely. `Size` therefore carries its size in both arms -- words are for a footer with room to spell a claim out, not a consolation for a mark too small to read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

A row here is one field with one answer, and its whole state is what the select says. A button beside each row was therefore a column of buttons all doing the same single thing -- which is the reasoning that took the Save button off the composer in July, and the reason the app's own version of this screen never had one. The two surfaces now agree. Saving on the change also removes the arrangement the render showed: a button in its own actions block under every select, so the rows sat at uneven distances from each other depending on how the label wrapped. Nothing is said on success. The box already shows the answer, so a sentence repeating it states the same fact twice -- and a single status line under a column of rows reads as belonging to the last row rather than to whichever one was just changed, which is exactly how it read. A failure still speaks: that is the one thing the select cannot show, since it goes on displaying a value the server did not take. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

`O3db::shutdown` consumed the handle, which cannot be reached through an `Arc` that a server and its worker threads share, and ended on a wait group that had been cloned into every handle -- so a shutdown waited for its own siblings and never returned. Both failures were silent hangs. `O3db::close(&self)` closes the store through any handle. The wait group and the record of what has been done now sit once behind a shared lock, so the wait answers the question it was asked and a second caller finds the work already finished rather than sending a request to a supervisor that has gone. Closing twice is safe and says so. `shutdown` remains, as a wrapper, so no caller changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01249XLp5okAu9g2qrMEBtsV

written by Jason Hoogland <hoogland@gmail.com>

A chooser needs the five rungs in words, and the composer, the console panel and the app's own screen were each about to keep their own copy. So declare.json carries the vocabulary beside the declarations and every surface renders from that -- one list, and no second one to drift. The declarations page now wears the same clothes as the settings pages beside it: a rendered console showed labels and selects landing in two different arrangements depending on how long the name was, because the form was not built the way the others are. Also adds a render dump for the reader's own screens, the counterpart of the console's. Both of this module's invisible defects were found by rendering it and neither by reading it, and until now the half a reader actually sees had no way to be photographed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

A declaration is a claim a person makes about their own work, so the module's whole shape follows from one rule: it must never draw a claim nobody made. An unknown rung, an unreadable record, an absent field and an author who has not chosen all read as no declaration, and no declaration draws nothing -- never the bottom rung, which is itself a claim and the one with the most to gain from being asserted quietly. A post carries its level in its own record, beside the prose it is about, and chooses it in the composer. Everything else a site shows is authored somewhere else -- a book in a catalogue, a project on a front page -- so the config names what may be declared for and a new Declarations page in the console is where an admin says what each one is. The store holds one word per item, and taking a declaration back deletes the record rather than storing a word for saying nothing. No scheme is named in the engine. The ladder is public and its words are ordinary English, but the site that defines them and the artwork that draws them are configuration, so a site declares under whatever scheme it declares under and one that configures none draws nothing anywhere. Two details worth keeping. The size rule is structural: a level is read by counting pins, the count fails as the mark shrinks, and a mark too small does not look broken -- so Size::alone will not return a wordless mark below 40px, and there is no way to spell the illegible arrangement. And the artwork is used as a mask over currentColor rather than as a picture, so one set of files reads correctly on a dark site and a light one without a per-site copy to keep in step. Also fixes a test left red by 7ee7931, which deliberately made the masthead say the site's name rather than what it calls its posts. The behaviour is right and is live; only the assertion had not caught up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN4DJ7n77QyC8VH2B6CwUN

written by Jason Hoogland <hoogland@gmail.com>

Three things, all from watching a real operator use it. The text message said "jarrah IS DOWN -- not answering for 3m, seen from karri." It now says "jarrah is DOWN". How long, which machine noticed and what was probed are in the email, which costs nothing to make longer; on a lock screen at three in the morning they are noise in front of the one word that decides whether you get up. The heartbeat is on a timer at last. The event, its wording and its routing all existed and nothing raised it -- so the path could rot silently, which is the one thing it was built to prevent. It rides the watch loop rather than a timer of its own, so a heartbeat arriving is evidence the watcher is running and not merely that something somewhere still fires. Monthly by default. And alerting no longer insists on an email recipient. jarrah cannot send mail at all -- its provider blocks outbound 25 -- so requiring a mailbox would have left the machine that most needs to speak unable to say anything. Mail or text, one of them is enough; neither can prevent the other; with no mail recipient it says so at start and sends only texts. Proved from both ends. karri texted its heartbeat, jarrah texted a deliberately failing peer, and the phone was silenced with Do Not Disturb on for the first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

Two things wrong with the sentence an operator actually reads. It called the machine by the first website in its config. karri serves four vhosts, and need2know.ai sorts first, so "jarrah is down, seen from need2know.ai" named a site with nothing to do with either end of it. The kernel knows the answer; /proc/sys/kernel/hostname is read the way fe2o3_sys reads everything else about a host, with the first vhost kept as a fallback for a system that carries no hostname. And the down message ended "Payments, credits, sync and mail on it are unavailable" -- Daimond's services, asserted by a library that has no business knowing them, and wrong for the second peer anybody adds. What a peer DOES is its name, which the operator chose and which travels with every message about it. The sentence now says only that it is not answering, and for how long. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

A jdat list arrives as Dat::List, or as Dat::Vek when it was written with the type tag. They mean the same thing to a reader, and a configuration file uses whichever its author typed. The alerts.to parser knew both; the alerts.sms.to parser I wrote beside it knew only one. So a number written in exactly the same form as the address above it read as an empty list, and Steel refused to start with "alerts.sms is enabled with no numbers in 'to'" -- correctly, since an alerter with nobody to tell is worse than none. It cost a deploy, which rolled itself back. Both now go through `strings_in`, so a third caller cannot make it three. Proven end to end afterwards: a deliberately-failing peer was watched for three rounds, and the refusal went out by mail (accepted by the recipient's MX) and by text (ClickSend SUCCESS) within a second of each other. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

I put tokio::spawn eighty lines below a comment that says, of the traffic and host samplers, that they are spawned inside Server::start and not here because this function is sync -- the runtime is built but not entered, so tokio::spawn would panic with "there is no reactor running". It does. rt.spawn is what the sealed-start alert twenty lines further down already uses, in this same function, for this same reason. The cost of not reading that comment: karri went into a systemd restart loop and its sites were down for under a minute before the rollback. The code compiles perfectly. It fails only when a server is actually started, which is the point worth keeping -- a change to this function is not tested until something has been started with it. NOT YET PROVEN BY A START. A scratch Steel exits cleanly before reaching this line, having no certificates and a sealed database, so the fix is reasoned from the established pattern rather than observed. It goes back on a live host only after it has been seen to start. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

alert.rs has said this in its own header since it was written: Steel reports on itself, so a Steel that is wedged or gone sends nothing, and silence is indistinguishable from health. On 2026-08-10 that stopped being a caveat. A payments gateway exited on its own and was down for about fifty minutes while the websites in front of it served perfectly. Nothing said a word, because the only thing positioned to notice was the machine that had died. So the question is inverted. Do not detect a failure -- require a success, on a schedule, from somewhere else, and treat its absence as the alarm. A mesh, not a monitor. Every node watches every other node it is told about and any node can raise the alarm, because a monitoring server is one more single point that fails quietly. Adding or removing a machine is one line of configuration and nothing else: no code, no central registry, which is the whole reason the peer list is data. Duplicate alarms are left in deliberately. Two watchers seeing one outage send two messages, and suppressing that would need the watchers to agree with each other -- a protocol, which is a thing that can fail and take the alarm with it. Two true messages cost a glance; one suppressed by a consensus that broke costs an outage. It does not restart anything. A watcher that repairs can flap a service in a loop at three in the morning and hide the fault it was built to reveal, and the decision to restart a payments process belongs to somebody who has read why it stopped. The second channel is a text message, through fe2o3_net::sms. Mail and SMS fail for different reasons -- mail needs a working MX and a mailbox somebody reads, a text needs a funded account and a carrier -- and two channels that fail independently is the entire value of having two. Both legs are attempted and neither can prevent the other. Severity decides which: a peer going down reaches a phone, an unseal does not, because an operator who is texted about routine events stops reading the texts. The credential is read from the environment and never from the configuration file. A config is copied between machines, pasted into a chat window to ask why a server will not start, and committed by accident; an environment variable is none of those by default. Heartbeat exists so the path is exercised. An alerting route used twice a year is broken when it is needed -- an expired credential, a rotated key, a changed number -- and it is discovered during the incident. If the boring messages stop, the alerting has failed and not the estate. Both new config blocks are #[optional], per the note the alerts block already carries: two live production configurations have never heard of either, and a required field would make both invalid the moment they read this binary. 230 Steel tests pass. The one failure, publish::page::test_an_unconfigured_mark_ is_the_title_27, fails identically on unmodified HEAD and is not from this work. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

A text message is the only alert channel that reaches a person with no data connection, and a host that has just gone dark is exactly when neither push nor mail may be to hand. So this is the last leg of an alerting path rather than a messaging feature, and it is deliberately small: one message, one receipt, no delivery webhooks, no inbound, no scheduling. Provider::request returns the parts of a call and stops, as Engine::request does beside it. The caller dials, because the caller is the one that resolves a host and refuses a private address, and a module that opened its own socket would walk around all of it. Every provider here reads its credential from an Authorization: Basic header, and that is the entry requirement rather than a coincidence. A vendor whose scheme puts the secret in the request BODY is excluded, because bodies are logged, echoed in error messages and captured by proxies in ways headers are not. Vonage is the notable absence on exactly that ground. The test asserts the property per provider rather than over a list, so a fourth arm added without thinking about it fails rather than quietly widening the promise -- and it also asserts the credential IS present, so it cannot pass by the secret having been dropped altogether. Two things a daticle taught me while writing the parser. It knows its own width and prints it, so reading a segment count by parsing Display returned zero for every vendor that sends the count as a number rather than a string; the widths are now matched out explicitly. The same applies to any scalar a receipt carries through, which is why a price is never parsed into a figure this module would then be claiming to understand -- it is passed on exactly as the vendor wrote it, in whatever currency the account is billed in. An error document is checked before the success fields, because two of these vendors answer a rejected credential with HTTP 200 and an object explaining themselves. A parser that read the receipt first would report a missing field where the vendor had written the sentence that says the account is out of credit. 284 tests pass in fe2o3_net, 7 of them new. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EUPCWxGhSwJtmzscpHRnMd

written by Jason Hoogland <hoogland@gmail.com>

A tool that searches has to name an engine, and the engines agree on nothing: one is a GET with the query escaped into the path, three are a POST with it in a JSON body, and each reads its key from a differently spelled header. So this is not the shape llm.rs has, where three providers speak one dialect and differ only in address. Each arm carries real code, and SearchResult -- title, url, snippet, age, every field a string -- is the narrow common shape all four are flattened into. Engine::request returns the parts of a call and stops. The caller dials. That is the point rather than an oversight: a caller that resolves a host, refuses a private address and repeats the refusal on every redirect hop has built a gate, and a module that opens its own socket walks around it. There is deliberately no convenience here that sends. parse is forgiving by the row and strict by the document. One malformed row out of twenty is not a reason to answer with nothing, so a result with no title or no url is dropped and the rest returned; an error document is an error, naming the engine and repeating what it said, because that text is the only place a rejected key is ever explained. Four vendors wrap that message four ways -- a bare string, an object with a detail, an object with a message, an object holding an object -- and each is unwrapped rather than any one assumed. age goes through exactly as the engine wrote it. The four disagree about what it measures -- publication, last crawl, or how long ago either was -- so it is never parsed into a timestamp, and a row that gave no date gets none. Two engines have no scholarly index and say so through supports(), which refuses the request here instead of sending one that comes back rejected. The tests found one thing worth recording. A bare JSON number decodes to the narrowest kind that holds it, so the U64 arm that read one engine's bare-year date never fired: 2017 arrives as a U16 and the date came out empty. Every integer width is answered now. Each test was also run against a deliberately broken copy of the code it covers, which caught a second defect in the tests themselves -- the error-document test passed with error detection removed entirely, because the fallback that dumps an unrecognised body happens to contain the message the test was looking for. It now also insists on the absence of a wrapper key that only the raw dump would carry.

written by Jason Hoogland <hoogland@gmail.com>

Every program that puts a file in front of a person answers the same question first, and there are only two places an answer comes from. The name is what somebody typed and the bytes are what is there, so they part company whenever a file has been renamed, exported wrongly or truncated. identify() asks both and reports the disagreement rather than quietly picking one -- a file called .png holding PDF bytes is how you find a broken export, and hiding it helps nobody. The mistake this is written to stop: reading unknown bytes as UTF-8 with a lossy decoder and showing the result. Every byte that is not valid UTF-8 becomes U+FFFD, so the reader gets a screenful of replacement characters and no hint that anything went wrong. The program looks broken rather than the format looking unsupported, and those are very different bug reports. Fifty-one formats with their signatures, media types and classes. One heuristic, looks_like_text, with its limits written on it -- including that a prefix cut mid-character is not evidence of binary, which is a defect that shows up once every few hundred files and never on demand. Checked against the file command over seventeen real files of seventeen formats; sixteen agree exactly. The seventeenth is deliberate and recorded: file reports a TrueType font as the generic font/sfnt while describing the same bytes as "TrueType Font data", and RFC 8081 registers font/ttf for what the 00 01 00 00 version tag identifies.

written by Jason Hoogland <hoogland@gmail.com>

A confirmation that lands in spam is a subscription that never happens, so the three things a large provider weighs were all wrong at once. - **No Message-ID.** Every message needs one; without it a message cannot be threaded or de-duplicated, and the large providers read its absence as the mark of something not sent by real mail software. Added to all three message kinds, unique per message and in the sending domain. - **The signature named the wrong domain.** One host serving several domains signed every message as whichever domain the mail config named, so a message From need2know.ai carried d=elearnity.oxegen.io -- unaligned, and therefore worth nothing to the receiver deciding whether to believe it. A DKIM key is not bound to a domain; what binds them is the record published under it. DkimSigner::for_domain re-derives the same key for the domain the message is actually from, and the caller must have published it there. - **No one-click unsubscribe.** The newsletter advertised a List-Unsubscribe URL but not List-Unsubscribe-Post, because the endpoint took only a GET. It now takes a POST at the same address with the token in the query, so the header can promise what the server actually does. Also, two things a reader sees. The subscription pages -- reached from a link in an email, which is the end of a road -- now offer the way back to the site. And the masthead's home link says what the site is called rather than what it calls its posts, which on any site setting `home` printed the same word twice, side by side, going to two different places. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN2RGNRPaRpURe2SL6nMpM

written by Jason Hoogland <hoogland@gmail.com>

`newsletter_from` is documented as `README <news@oxedyne.com>`, and that whole string went into `MAIL FROM:<...>`. A receiving server refuses that reverse-path with a 5xx; this module reads a 5xx as a permanent failure and answers it by suppressing the subscriber. So the documented shape of the field would have marked every address it was ever used with as bounced, and never mailed any of them again -- a configuration that looks right, sends nothing, and quietly burns the list as it goes. The header keeps the display name, which is what a reader sees. Only the envelope is stripped to the address. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN2RGNRPaRpURe2SL6nMpM

written by Jason Hoogland <hoogland@gmail.com>

The subscribe endpoint is unauthenticated and its effect is a piece of mail to an address the sender chose. Bare, that is a mail-bombing tool wearing the site's own domain, and the cost lands on the sending reputation every later confirmation depends on -- not on the disk. The comment endpoint next door already had a honeypot, a challenge and per-sender rate limits; this one had none of them. Three layers now, and none of them tells the sender which one caught it: - The field no person fills in. Filled means a machine filled it, and the submission is dropped and answered with the ordinary page, since telling a bot it was spotted only teaches it which field to leave alone. - A limit per sender, keyed on a salted hash of where the request came from. Over it, the same page again: a form that says "too often" tells a script exactly what it has found. - Double opt-in, which was already here, capping the worst case at one message per address rather than a correspondence. rate_allows gains rate_allows_at so the sign-up counter is kept apart from the comment counter: a reader who has just commented has not thereby spent their sign-up. from_hash gains hash_with for the same reason at the hash -- one address must not produce the same value in both counters. The two new config fields default to limiting rather than not, because the failure worth designing against is the block that predates them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CN2RGNRPaRpURe2SL6nMpM

written by Jason Hoogland <hoogland@gmail.com>

The other container a family library holds, and one nothing in the workspace could see. The header list is at the front, so a caller holding a sniffing buffer gets the same answer as one holding the file, and no frame is decoded -- what is inside is Motion JPEG or DV and that is the caller's business. The stream header's length is preferred to the main header's frame count: the latter is a single 32-bit field written before the file was finished, and the OpenDML extensions leave it nought once a file passes four gigabytes. Held to ffprobe over 531 real films: all 531 agree on size and running time, worst difference 144 ms, none refused.

written by Jason Hoogland <hoogland@gmail.com>

tokio-rustls was taken with its default features, so every caller linked aws-lc-rs -- a second cryptography library, in C -- including callers that serve plain HTTP and use none of it. Cross-compiling it for Windows builds its POSIX threading backend for a target with no pthreads, and the link then wants the posix mingw and -lwinpthread for fifteen symbols. fe2o3_steel already pinned rustls to ring, so this brings one crate into line rather than setting a policy. The manifest was only half of it. cargo check across the workspace passed while tls.rs still named crypto::aws_lc_rs, because a workspace build unifies features and another crate kept that module alive. It failed only when building a downstream application outside the workspace.

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

Nine 4K films code all-intra pictures interleaved with bidirectionally predicted ones, so the first picture shown is not the first sync sample. Comparing the two decoded different moments and disagreed in every sample with nothing to say why. Select the first intra picture on both sides. A picture's slices must tile it, so a macroblock left undecoded is now refused by name: for an arithmetically coded slice that is the only sign a desynchronised coder gives, since it goes on answering bins. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

A film may carry a clean aperture in its sample description and FFmpeg crops to it; a decoder produces what the coded stream describes. One film in the corpus is coded 1440 by 1080 and asks to be shown as 1308 by 980. A size disagreement is now recorded as a difference rather than ending the survey, so one odd film cannot stop the rest being measured. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

A corpus probe that reports rather than asserts: how many of a library's H.264 films give up a first frame, split by entropy coder, and every refusal by name and count. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

CABAC, clause 9.3: the decoding engine, the context variables an intra 4:2:0 slice draws on, the binarisation of every syntax element above a block, and the reading of a block of coefficients. The 261 initialisation pairs are transcribed by hand and held to the specification text entry by entry, along with rangeTabLPS, the state transitions and the scan position mapping of Table 9-43. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

Three things a film has and a photograph does not, each of which made the reader hand back a picture that was refused or wrong. A film's first frame is very often a clean random access picture rather than an IDR. It is decoded exactly as one -- it references nothing before itself -- but its slice header carries the picture order count and the reference picture set that an IDR's does not, because the pictures after it may reference what it names. Read as though it were an IDR's, the header comes apart from that field on: 67 films in a library of seven thousand were refused for naming five pieces of a picture thirty-four rows deep. The fields are held to FFmpeg's own trace of the same bytes, element by element. The sequence parameter set's video usability information is now read as far as the default display window, which also yields the two things a colour conversion should not be guessing: the range and the matrix. And a film's clean aperture is read from the container. A phone stabilises a film by coding a picture larger than it shows and moving a window about inside it, and the window is a `clap` box in the sample entry. Ignoring it hands back nine per cent more of the frame than the film shows. Twenty-five of the thirty-three films sampled from the corpus carry one, and with it applied thirty-two of them match FFmpeg sample for sample where seven did before. The reserved slice header bits are also read where the specification puts them, before the slice type rather than after it.

written by Jason Hoogland <hoogland@gmail.com>

A track header's matrix is a, b, u, c, d, v, x, y, w. The reader took the first four for a, b, c and d -- but `u` sits between b and c, and `u` is nought in every matrix a camera writes, so the pattern for a quarter turn could never match. Every rotated film in a library of seven thousand was read as upright. The test agreed with it because the test wrote the matrix the same wrong way round, which is a test proving that a reader agrees with itself. It now writes the entries where the specification puts them, and a real film out of the corpus was the thing that disagreed. `rotation_of` is now a function of its own, so the same reading serves a caller holding a track header without a whole film behind it.

written by Jason Hoogland <hoogland@gmail.com>

A photograph is one slice coded in wavefronts and every one in the corpus is, so that was the only shape the decoder read: a picture whose slice carried no entry points was refused for having only its first row findable, and a second slice segment was refused by name. Both are ordinary in a film. Without wavefronts a slice is one arithmetic decoder from its first block to its last, with the contexts carrying across row boundaries rather than being reset at them. And a picture cut into slices is several, each beginning at the block its header names, each starting the arithmetic decoder afresh -- and each predicting from nothing outside itself, which is the point of cutting one, so availability gains a second half beyond decoding order. What is still refused is refused by name: a dependent slice segment, the pair of slices and wavefronts together, and a picture whose loop filters are not to run across the boundaries between its slices.

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

Nothing here holds a film and nothing here uses a fixture. The corpus is somebody's actual library, written by a dozen phones and cameras over twenty years, and FFmpeg -- which has no idea this crate exists -- is the oracle for every sample. The first test reports rather than asserts, because how many films can be drawn today is a measurement and not a promise. The rest assert: a sample of posters must match FFmpeg sample for sample with `-noautorotate`, a film the container says is turned must come out of FFmpeg's own turn transposed the way the reader says, and reading an index and one sample must read less than the whole file.

written by Jason Hoogland <hoogland@gmail.com>

Both video decoders here produce the same thing -- three planes, the colour ones at half size -- and for a while they produced it as two unrelated types with the conversion into red, green and blue written against only one of them. So an H.264 frame was a picture nothing could draw. `yuv` names the shared form: `Frame`, `Plane` and `rgb` are the hevc ones, and an H.264 picture reaches all three through `From`, which widens its eight-bit samples. Nothing is a second implementation of anything, and no existing signature moved.

written by Jason Hoogland <hoogland@gmail.com>

A coded picture is a whole number of coding tree blocks and a shown one is not: a 1920 by 1080 film is coded 1920 by 1088, and the eight rows the encoder filled to reach the block boundary are not part of the film. The HEIC path never met this because it crops to the size the container declares, but a film has no container property to ask -- only the sequence parameter set's conformance window. `picture_shown` is `picture` with that window applied. `picture` is left as it was, because cropping there would take the same rows off twice on the HEIC path.

written by Jason Hoogland <hoogland@gmail.com>

The sample table says where a film's first frame is, and a caller wanting one frame of a four-gigabyte film should never have to hold the other four gigabytes to get it. `moov_of` lifts the movie box by walking the top-level box headers -- eight bytes and a seek each, an `mdat` stepped over by its declared length and never touched -- and `Film::of` indexes a track from it. `Film::read_sample` then fetches the one sample the index names. `mvhd_of` is the cheaper half for a caller that only wants to know how long a film runs: the movie header alone, without a long film's sample tables, and `movie_ticks` reads the timescale and the duration out of it. Every downstream reader of running times had a copy of this walk; now there is one.

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

Three things in one downstream app want the same five lines -- an album's name, a person's name and a saved search's: drop control characters, because a newline in the middle of a name is a paste gone wrong; trim the ends; bound the length in characters rather than bytes, so a limit means the same thing in every script. Nothing is answered where nothing readable is left, since the caller is the only one that knows what to say about it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KTgzDMQVmSpnWuELRfx9JM

written by Jason Hoogland <hoogland@gmail.com>

The WebSocket terminal bridge is the only thing in the workspace that reaches for nix, and it rests on a pseudo-terminal whose slave end becomes a child's three standard streams -- a pair of ideas Windows has no counterpart to. The bridge is therefore gated to Unix and nix moves under a cfg(unix) dependency, so the crate no longer carries a POSIX-only dependency on a platform that cannot use it. Where there is no pseudo-terminal the bridge completes the handshake and then refuses by name. The handshake happens first on purpose: a socket closed before it opens carries no reason, and a browser reports only that the connection failed.

written by Jason Hoogland <hoogland@gmail.com>

Merges the H.264 intra decoder and the MP4 reader that finds what to hand it, together with the parameter-set selection that lets the existing HEVC decoder reach a film as well as a photograph. Verified over the whole library before merging: 1,658 H.264 films, 25,889 header fields agreeing with FFmpeg and none disagreeing, 711 of 711 CAVLC films exact sample for sample, and 947 CABAC films refused by name. 267 unit tests. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

`picture` kept the last sequence and picture parameter set the configuration record carried. A photograph out of a camera carries one apiece, so either would do and nothing showed. A film carries several, and a slice names which it was coded against -- so four films in ten were refused for referring to a set that was in hand all along. Both are now chosen by identifier: the picture set the slice names, and the sequence set that one belongs to. Reading which set a slice wants needs no set, because the identifier is the third element of the header and nothing before it depends on one, so `slice_pps_id` reads it and the choice is made before the header is parsed. Measured over the real library, on a decoder written for still photographs and pointed at films: 66 of 150 HEVC films drew a first frame before, and 142 of 150 after. What is left is seven pictures cut into more than one slice and one film at ten bits, both refused by name. This matters more than it looks. Three quarters of the 7,242 films in that library are HEVC, not H.264, so the decoder that was written for HEIC already reaches about five thousand of them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

House rule, and the two that slipped in were on an Option rather than an Outcome, which is why they read as ordinary code.

written by Jason Hoogland <hoogland@gmail.com>

The colour conversion out of 4:2:0 is the same arithmetic for H.264 and HEVC and lives in one of them, over a picture type the other does not share; and nothing in a coded picture says which way is up, so the track header's angle is the caller's to apply. Both are recorded where a caller will look for them.

written by Jason Hoogland <hoogland@gmail.com>

Found by decoding all 1,658 H.264 films against FFmpeg: 707 of the 711 CAVLC ones matched sample for sample, and four files -- two films, each stored twice -- differed by at most five levels, starting three rows above the line where their second slice begins. That is the filter's exact reach across a horizontal edge, and the cause was that the deblocking disposition was read from the first slice and applied to the picture. Both films set `disable_deblocking_filter_idc` to 2: filter everything within the slice and nothing across its boundary. Each slice's thresholds are its own too, and are now carried per slice rather than per picture. The corpus comparison is now a gate rather than a report: any film that decodes to something other than what FFmpeg decodes fails it. A picture that is nearly right is a wrong picture.

written by Jason Hoogland <hoogland@gmail.com>

The module doc now states plainly that the CAVLC half is complete and verified and the CABAC half is not written, that this is 711 films against 947, and what writing it will need — including the one thing worth knowing in advance, that Tables 9-12 to 9-33 cannot be parsed out of a text rendering the way Table 9-5 was, because their digits wrap across lines. Beside it, two tests on the container: a film the writer wrote is read back sample for sample, and a track header's transformation matrix is read as the angle it codes. Both were proved against the broken behaviour first — the rotation test fails when the matrix offset is moved by one field. The deblocking filter's strength-2 machinery is removed rather than kept unreachable: the coefficient and motion tests come after the intra test, so an all-intra picture never reaches them.

written by Jason Hoogland <hoogland@gmail.com>

The macroblock walk, the deblocking filter, and the CAVLC path end to end. Every H.264 film tried so far comes out identical to FFmpeg's own decode, luma and chroma, every sample. Four faults found by that comparison, none of which fails on its own: - The coefficients of a 4x4 block were never inverse-scanned, so every one sat at the wrong frequency. - §9.2.4 lays the levels out from the *last* one read, walking forwards through the block; starting at the far end and walking back is plausible and wrong. - A block's predicted mode was read from the picture rather than from the macroblock being built, so every in-macroblock neighbour offered DC. - §8.3.1.1's `dcPredModePredictedFlag` is one flag, not two: if *either* neighbouring macroblock is unavailable, *both* modes become DC. Taking the minimum of the available neighbour and a notional 2 differs on every block along the top and left edges of a picture. And one in the oracle rather than the decoder: a phone writes the angle it was held at into the track header, and FFmpeg turns the picture on the way out. At ninety degrees the turned picture has exactly as many samples as the untured one, so nothing but the samples says so. `mp4::Film` now reports the rotation, and the comparison asks FFmpeg not to apply it.

written by Jason Hoogland <hoogland@gmail.com>

The three layers under the macroblock walk, each held to the published specification rather than to itself. The scans of Tables 8-13 and 8-14, and the norm adjustment matrices of equations 8-315 and 8-318, are re-read out of Rec. ITU-T H.264 by the tests. So are all 372 entries of Table 9-5, which is far too many to type in: the tables were parsed out of the document, and every column is separately asserted to be a prefix code, which is the property a codeword one bit short or one place out of its column almost always breaks. Two things recorded because they ruin a picture without failing: - An absent scaling list means "inherit", and at the head of each fall-back chain it means the default matrix of Table 7-3, which is not flat. 33 films in the corpus carry lists. - Intra_8x8 predicts from *filtered* reference samples. Leaving the filter out gives a picture right in its large shapes and wrong in every block's texture.

written by Jason Hoogland <hoogland@gmail.com>

An MP4 reader beside the writer, and the H.264 parameter sets and slice headers that come out of it. The reader holds an index rather than a film: the corpus this was written against runs to 91 GB and one film in it is 4 GB on its own, so a sample is a span and the bytes are the caller's to fetch. Held to FFmpeg's own header tracer over the library, which is a separate parse of the same bytes by a separate implementation. Two faults it caught, both of which produce a plausible answer rather than an error: - A sound track's sample entry was read as though it were a visual one, so a film with audio in it was refused for the shape of a track nobody asked about. - QuickTime puts a second `hdlr` inside `minf` naming the data handler, and taking whichever `hdlr` came last decided a 2003 camcorder's film had no video in it.

written by Jason Hoogland <hoogland@gmail.com>

Four documents had drifted from the code they describe, and each was found by reading them against it rather than by a test. The decoder's own header still listed as "still to come" the quadtree, the residual coding, the transforms, the prediction, both loop filters and the colour conversion -- all of which it does. Its refusal list was wrong in two directions at once: it claimed to refuse scaling lists, which it reads and applies because two in five of the corpus carry their own and the default lists are not flat; and it claimed to refuse palettes, cross-component prediction and residual rotation, which are enabled by parameter set extensions this reader stops before. Such a stream is neither refused nor decoded correctly -- it is outside what is read at all, which is a weaker guarantee than a refusal and now says so. The container module said it "decodes nothing either", which stopped being true when heif::decode was written. The whole-image test said the two implementations "will not agree sample for sample and are not asked to", on the grounds that the loop filters were not yet run; they are, and the test asserts the worst difference over every tile is nought. And a doc comment in heif named an application, which this library's documentation does not do. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

The network gives three heads a class score and a box per position, and the box is not four numbers: it is four distributions over eight bins, and the distance to each side is their mean. So a side is a softmax and then a dot product against the bin indices, times the stride. The positions are not the centres of their cells. They sit half a sample short, at i*stride + (stride-1)/2, which every reference implementation of this model does and which is the easiest thing here to get wrong. Taking the centre instead does not merely shift a box: it changes which boxes survive the suppression, and the test that proves this catches it by finding fourteen objects where there are fifteen. The suppression is deliberately blind to the category. Two boxes on one animal, one calling it a dog and the other a cat, are one animal; keeping both would report the network's disagreement with itself as a pair of findings. On this library that disagreement is not hypothetical -- the same black dog is called a cat in three photographs out of a sample. Held to the reference's own decoded boxes on six real photographs: same count, same categories, same scores to a part in a hundred thousand, every edge inside a quarter of a pixel. Both faults above were measured against it first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

A category detector's backbone splits its channels, sends half down a branch, joins them again and then interleaves them, which a channels-first model writes as a reshape into five axes, a transpose of two of them and a reshape back. In a channels-last layout none of that touches the spatial axes and the whole run is a permutation of the innermost one, so the two reshapes come to nothing and the transpose is the permutation. That is matched as a run of three nodes rather than node by node, deliberately. Each of those operators alone would need a real permutation of a channels-last activation, and it is only together that they are free; a graph using one on its own is refused rather than quietly mishandled. The same goes for the reshape and transpose a detection head ends with, which together are one reshape that moves no value. Held against OpenCV's own DNN engine on six real photographs, one letterboxed the other way up: 225 nodes and six outputs, worst disagreement 7.2e-6 on values of order 4, which is two engines summing a convolution in different orders. The test was proven on the broken cases first -- dropping the channel shuffle differs by 16.9 and reading the resize by the other coordinate rule by 2.7, both six orders of magnitude above the noise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

The maximum pool was two by two, stride two, no padding, and the resize was an exact nearest-neighbour doubling, because that is all YuNet asks for. A category detector asks for a three by three pool at stride two with a pad of one, and for a bilinear resample both up and down, so both kernels are now general and the two special cases fall out of them as parameters. The mode and the coordinate convention are read from the graph rather than assumed. They differ between the two models -- one writes nearest and asymmetric, the other linear and pytorch_half_pixel -- and half a sample of disagreement moves every box a detector predicts. Padding contributes nothing to a maximum rather than contributing zero. Zero is not the identity of a maximum, and after a leaky rectifier a whole window can be negative, so a padding zero would be the answer at every edge. There is a test that fails on exactly that. The two tests holding the face detector and the embedder to what tract answered still pass, which is what says the generalisation left the existing models alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPpo3dbkNNo28cwZZJ9Siv

written by Jason Hoogland <hoogland@gmail.com>

A photograph off a phone arrives with an Exif block naming the camera, the moment and, very often, the coordinates of whoever pressed the shutter. Publishing the file publishes all of it, and the caller has to remember to prevent that. strip_metadata walks the marker segments and drops the ones that describe the picture rather than encode it, leaving the entropy-coded scan untouched. The result decodes to identical pixels: verified against an 11.6 MB iPhone photograph carrying eleven Exif fields and a GPS ifd, which came out with none of them and no pixel difference. JFIF, ICC and the Adobe colour transform are kept, since dropping those changes how the file renders. Everything else in the application range goes, along with comments -- which takes XMP, IPTC, maker notes and any JUMBF or C2PA assertion with it, so a caller relying on embedded provenance must read it first. The doc comment says so.

written by Jason Hoogland <hoogland@gmail.com>

`jpeg::dimensions` already existed; `png::dimensions` did not, so a caller that only needed to know how big a PNG was had to decode the whole of it. That is the wrong shape whenever the answer is used to decide whether to keep the pixels at all — costing a megabyte of allocation to find out that a megabyte is too much. It reads the signature and the mandatory first IHDR chunk, twenty-nine bytes whatever the file weighs, and validates through the same `decode_header` the decoder uses so the two cannot disagree about what a valid header is. The caller that wanted it prices an image in visual tokens before sending it to a model, where the cost is a function of width and height and nothing else.

written by Jason Hoogland <hoogland@gmail.com>

Test fixtures across three workspaces were writing into std::env::temp_dir(). On the machine this was found, /tmp is a tmpfs, so every fixture is resident memory the test binary never gives back -- 34,795 directories at the point of measurement, 67,413 at its peak, and nothing had ever removed one. scratch_dir(label) puts them under the user cache instead, refusing any candidate under temp_dir() or literally under /tmp rather than silently falling back to it. The name carries the owner's pid, so bounding is by sweep rather than by Drop: a Drop is impractical where the fixture holds a database whose bots run on their own threads, and where the caller keeps no guard at all. The first call in a process removes what no live process owns. Uniqueness is settled by the filesystem -- create_dir, not create_dir_all, retrying on AlreadyExists -- because nanoseconds do not survive two processes and a pid does not survive two calls. Ten more temp_dir() fixtures remain in fe2o3 itself and are named in the module doc for a later pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TNA7XFwaxJFGyRsXJm3CQo

written by Jason Hoogland <hoogland@gmail.com>

byte.rs, path.rs and version.rs each imported a macro they invoke, and each resolves without the import because both crates declare their macro module `#[macro_use]` ahead of everything else. Stable is silent about it; nightly is not, and a warning on every downstream build is how a real one goes unread. Checked before deleting rather than after: every invocation is at module top level or in a plain impl, none cfg-gated, and neither crate has a [features] table, so there is no configuration under which the import becomes load-bearing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TNA7XFwaxJFGyRsXJm3CQo

written by Jason Hoogland <hoogland@gmail.com>

An app wanting to search a tree needed both, and either written in the app would have been the wrong place: a second caller for "does this line match" and "does this path match" is not hypothetical. regex is a backtracking matcher over an enum AST: literals, classes with ranges and negation, the \d \w \s shorthands and their negations, anchors, word boundaries, groups and non-capturing groups, alternation, and the repetitions greedy and lazy. No captures, deliberately -- a line search never asks which part matched, and leaving them out makes the matcher one recursive walk rather than a machine with a capture stack. glob takes *, ?, **, character classes and brace alternation. A pattern with no slash matches the basename, one with a slash the whole path, which is what a person means by both. Bounded against its own recursion, and the bound is measured rather than guessed. The first draft recursed once per repetition iteration, so .* over a minified 667 kB single-line file overflowed the stack -- found because breaking the empty-repetition guard did not fail a test, it aborted the test process. Single-character repeats are now counted in a loop, and what remains is bounded by stack bytes actually consumed rather than by a frame count: measurement put a debug frame at 5.4 kB against a fraction of that optimised, so no fixed count is both safe and useful. A line the matcher gives up on is reported as undecided, never as a line that did not match. Verified against grep -E rather than against its author: eight patterns over 25 files of real source, 1,675 matches, no disagreement. Twelve properties were each proved by breaking the code first -- . crossing a newline, lazy behaving greedily, alternation preferring the longest arm, case folding missing inside a class, ** matching no segment, a bare pattern tested against the whole path -- and confirming the test failed before it passed. No new dependencies.

written by Jason Hoogland <hoogland@gmail.com>

Two gaps in the terminal model, both of which showed as a screen a reader could not trust. The DEC special graphics set was ignored, so an ncurses programme drawing a box got letters where lines belong -- q for a horizontal rule, x for a vertical one. G0 to G3 designation, the locking shifts, and save, restore and reset now carry the character sets, and the mapping applies only to the printable ASCII range so UTF-8 passes through untouched. Columns rewrap on resize rather than truncating, which the previous commit ruled out and this one answers rather than overrides. The objection was that a continuation flag means nothing once a full-screen application has drawn over the grid, so a reflowing terminal scrambles an editor. It still would: the flag is set in one place, cleared by an erase that reaches the row's end, and the alternate surface is truncated and never rewrapped. What rewraps is the history a person scrolls back through, which is where the loss was felt. The oracle earned itself a third time, and this round it disagreed with tmux about tmux. Reflowing a mixed-width line, tmux 3.6 breaks aa世世世 after four columns of six and after six of eight -- neither being where tmux itself breaks when the same bytes are printed at that width. Printing is the definition a rewrap has to meet, so those cases compare against the print path, and the disagreement is written down rather than quietly adopted. It also caught the column left empty ahead of a double-width character that will not fit: indistinguishable from a printed space, and a rewrap eats a column. That padding is now its own state, which the renderer will need to know. Sourced throughout: every expectation is transcribed tmux output, never typed. The two that are not -- DECSTR resetting the sets, and the wide-character rewrap rule -- come from the VT510 manual and ECMA-48 and say so in the code. Sixteen rows of a real curses programme match cell for cell at four chunk sizes, and 116 mixed-width reflow comparisons match with none outstanding. tests/draw.rs and tests/main.rs compile again, having imported modules that moved under lib_tui long ago. One expectation changed rather than the code: AbsRect::clip answers None where it once gave a zero-width rectangle, and None is what tbox.rs matches on. No new dependencies.

written by Jason Hoogland <hoogland@gmail.com>

Bytes from a pty in, a grid of cells out. A VT500-shaped state machine over C0, CSI, OSC and the string escapes, feeding a screen with attributes, a cursor, a scroll region, tab stops, an alternate surface, bounded scrollback and a damage model so a renderer repaints only what changed. Generic by nature and so it lives here rather than in the app that wanted it: a second caller for a terminal model is not hypothetical, and the crate is already the terminal one. Verified against a real terminal rather than against its author's reading of the specification: 37 handwritten cases compared with tmux, plus nine recorded real programmes -- ls --color, top, man, grep, a progress bar, vim and less -- replayed through both and compared cell by cell, fed in varying chunk sizes. The oracle earned itself twice. It caught DECSTR homing the cursor, which several references describe and neither tmux nor xterm does. And it disagreed about lines scrolled out of a mid-screen region, where tmux pushes them into history out of order; a line is kept here only when the region starts at row 0 on the primary surface, and the disagreement is written down rather than quietly resolved. Columns truncate rather than reflow, deliberately: reflow needs a continuation flag per row that means nothing once a full-screen application has drawn over the grid, so a reflowing terminal scrambles an editor. Bounded by construction throughout -- a fixed parameter array, string payloads dropped past 8 kB while the scan for the terminator continues, scrollback capped and evicted. A 10,000-line flood costs one repaint of 24 rows. No new dependencies.

written by Jason Hoogland <hoogland@gmail.com>

A websocket frame states its own payload length in as much as 64 bits, and the reader allocated that many bytes before reading them. Ten bytes on the wire -- two of header and eight of length -- and any fe2o3 service reading frames attempts an allocation of whatever number the sender chose. The test written for this aborts the old reader outright: "memory allocation of 9223372036854775807 bytes failed", SIGABRT, from a peer that sent ten bytes and then nothing. `WebSocketLimits` bounds it, and carries two numbers because one bounds nothing. `max_frame` bounds a single frame; `max_msg` bounds the assembled message, since a message may arrive as any number of continuation frames each comfortably under the frame bound, and they are joined in one buffer. Defaults of 16 MiB and 64 MiB; `read_message` takes them as an argument and `WebSocket::with_limits` replaces a socket's pair. There is no way to say "no bound". Three things about the check rather than the numbers: - It is made on the 64-bit value that came off the wire, before that value is narrowed to a `usize`. Narrowing first truncates on a 32-bit target, where a declared 2^32 + 1 bytes would pass any bound at all as one byte. - It precedes the allocation, not the read. An over-limit frame costs the header it was declared in; nothing is reserved and the payload is never read. The test asserts the payload bytes are still unread when the error comes back. - It is answered. The error carries `TooBig`, `WebSocket::read` sends a close with status 1009, and `listen` ends the connection instead of counting the breach as one error among a permitted few -- it has to, because the refusal leaves the stream part way through a frame and there is no boundary left to resynchronise to. The tag is repeated on the `res!` wrapper deliberately. `Error::tags` reads the outermost frame of an error and not the chain beneath it, so a tag only on the inner error is a tag no caller will find. Also here: a control frame declaring more than 125 bytes is refused, which RFC 6455 §5.5 has always required and which a generous limit would otherwise let through; and the HTTP body reader reserves at most `HTTP_BODY_RESERVE_MAX` against a `Content-Length`, so a caller that set no `max_body_bytes` -- an outbound client, or a test -- no longer hands a stranger's header straight to the allocator. The body still grows to whatever genuinely arrives. The other length-prefixed readers in the crate were checked and already bound what they read: IMAP literals against `IMAP_MAX_LITERAL` server-side and `MAX_LITERAL_BYTES` client-side, SSDP into a fixed datagram buffer, SMTP lines against `SMTP_MAX_LINE`. Steel's ws relay copies bytes without decoding frames. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015YzxdhSaiMcStfA59dmvQW

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

`fe2o3_syntax`'s front-page example named a constructor that does not exist, used a variable it never made, and reached for the `?` operator this codebase does not use. It has never compiled, which is why `cargo test -p oxedyne_fe2o3_syntax` has been red for as long as the doctest has run. Replaced with the shape the crate actually has: configuration structs, `res!`, and a message read by matching. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

The proof of work on every packet is bound to both ends' addresses, so both ends have to agree on what those are. Two ways they could disagree, and both would have shown up as every packet failing validation for no visible reason: - A client socket bound to the unspecified address reports that address as its own, while the receiver sees whichever interface the routing table chose. `Client::source_ip` asks the same routing table the same question, using a throwaway socket connected to the same destination, and uses the answer. - A server bound to the wildcard address is not told which of the machine's addresses a datagram arrived at, and so cannot reconstruct what the sender bound its proof to. `Server::bind` now refuses that address and says why, which is a better way to find out than every packet being dropped. `NoDatabase` joins `fe2o3_iop_db`, for the callers -- a Shield server among them -- that are parameterised by a `Database` because they *may* hold one and are perfectly usable without. Naming a real implementation in order to pass `None` meant taking a dependency on one. Every operation refuses rather than answering emptily, so a caller reaching for a database it does not have is told at the call. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

The crate could send a signed, proof-of-worked, chunked packet and its server could receive, validate and reassemble one, and then nothing happened: no message type carried a caller's bytes, no handler could answer, and the only `recv_from` in the crate was the server's own loop, so a dialling peer had nowhere to hear a reply. A library user could not carry a byte. Added, all of it generic: - Two message types (1,024 and 1,025) and their syntax commands, carrying an opaque payload the protocol chunks, proofs, signs and reassembles without reading. Types at or above 2,048 are the library user's own. - `Answer`, which a handler returns: nothing, or bytes that go back under the message identifier the question arrived with, to the address it arrived from. Correlation is the packet header's message identifier, so the answer needs no second connection -- which is what makes it reach a peer behind a router. `ShieldCommand::build` therefore takes the identifier rather than drawing one, because a caller that could not say which identifier its question went out under could not recognise the reply. - `Client`: bind, `tell`, `hear` with a timeout, `ask`. It validates what arrives with the same `Protocol` a server does, and drops anything that is not the answer it is waiting for. - `Protocol::accept`, which is the packet path both halves share -- guard, validate, assemble -- with dispatch left to the caller, because a server answers requests and a client hears answers. - `Server::bind`, separate from `run`, so a caller can learn where the server landed before the loop that never returns starts. The loop is now on tokio's socket rather than a blocking one polled from inside an async function. Four things were wrong on the way, and are fixed here: - `server_address` did nothing: the server took the machine's network address whatever the configuration said, so loopback could not be asked for and two peers could not be run on one machine. An empty setting, or the word `local`, still means the machine's own. - A packet that was not part of the handshake sequence skipped the address guard entirely -- so no rate limit applied to it, and, since the guard is what creates the address log the difficulty is read from, such a packet could not be validated at all. Every packet goes through the rate limiter now; only the sequence check is skipped, because there is no sequence to be out of. - A packet carrying the key it was signed with, outside the opening handshake request, had its signature reported as *unchecked* rather than failed, so it was accepted on its proof of work alone -- by anybody willing to spend the work. It is now refused, except for the two application types, which travel outside any session and so have no other way of carrying a key. - The difficulty curve narrowed the measured request rate to a `u16` before multiplying by it. A burst measured inside one millisecond reports a rate of `u64::MAX`, which became an arbitrary number and then overflowed on the way to demanding more zero bits than the hash has. It saturates at the configured maximum instead. `tests/wire.rs` runs two peers on one machine over the real wire: a payload of several chunks round-tripping, two exchanges at once each finding its own answer, an answer under an identifier nobody asked under being refused, a well-formed packet with one byte altered after signing being dropped while the same packet unaltered is answered, and rubbish of six shapes not stopping the loop. The two examples in the crate's own documentation, which named an API that has never existed and had never compiled, now describe the one that does. The commented-out HResp1 machinery is left commented. Nothing here pretends the handshake exists: no session is established and nothing is encrypted, so a deployment must fix its difficulty -- `server_pow_zbits_min` equal to `server_pow_zbits_max` -- because a difficulty that rises with the request rate would silently stop a peer that has no way of being told about the rise. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

A syntax gives every argument a canonical name and one or two hyphenated aliases. A message read off the wire was filed under the canonical one and a message built by hand under whatever the caller happened to type, so the same argument had two names depending on which way it was travelling. A required argument added as `-zb` failed validation for being absent, and one that arrived as `PowZeroBits` could not be read back as `-zb`. Both halves of every message the SHIELD protocol builds went through that, which is why none of them had ever been sent. Names now resolve to the canonical one on the way in and on the way out, in `Msg` and in `MsgCmd`. An argument the syntax does not know keeps the name it was given, so a lookup of something absent still answers `None`. A message printing itself said its arguments by the name it files them under, which is not one a reader could type back, and said each command's name twice. It now prints the short hyphenated form, so `from_str` can read what `to_string` wrote -- which the crate's own test suite has been asserting, without running, since the error macros changed under it. That test file is repaired here: seven `err!` calls in the pre-`;` form, which is what stopped it compiling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

Deblocking and the sample adaptive offset. Both are IN the loop -- the encoder ran them too -- so a decoder that skips them is not showing a rougher picture, it is showing a different one. Sixty photographs across three years now decode identically to ffmpeg with both filters running at both ends, luma and chroma, no difference anywhere. The tests no longer pass -skip_loop_filter; HEVC_NO_FILTERS turns them off at both ends, which is how a fault in the codec proper is separated from one in the filters over it. The deblocking filter is short here because every coding unit in a still picture is intra, so every boundary that is filtered at all is filtered at full strength -- no motion vectors or reference indices to weigh. What it still has to get right is when NOT to filter, and that is what the tests are about: a step of a hundred and forty levels across a boundary is something in the photograph and must survive, while a step of four is an artefact of coding and must go. Both are put at the same place with the same settings, so nothing but the size of the step can account for the difference. **The second threshold table was shifted by one place from index twenty-six on**, and what it produced was a filter that smeared a real edge -- caught only because that edge was in a test on purpose. So both tables are now parsed out of the specification and compared entry by entry, the same discipline the context initialisation values and the transform matrix are held to. The offsets read the picture the deblocking filter left and write somewhere else. A sample that has already been offset must not be what its neighbour is compared against, or the offsets walk across the picture.

written by Jason Hoogland <hoogland@gmail.com>

The fixture wrote columns before rows, to match a reader that read them that way, and the two wrongs made a passing test. What settles it is a real photograph: 3,088 samples wide out of 512-sample tiles needs seven across, and only one reading of the box gives seven.

written by Jason Hoogland <hoogland@gmail.com>

The whole way from a HEIC file to a picture: the container's boxes, every tile through the decoder, the grid assembled, the photograph cropped out of its top left, and colour difference turned into red, green and blue. **A bug in the container reader that nothing had exercised**: the grid box gives rows before columns and they were read the other way round. A photograph 3,088 wide out of 512-sample tiles needs seven across and five down; read swapped it came out five across and seven down -- which counts to the same thirty-five tiles, so the existing check that a grid names as many tiles as rows times columns passed all along. Nothing found it until something assembled a grid. The assembly is checked tile by tile against ffmpeg's decode of each tile -- ffmpeg exposes each one as a stream of its own -- so a grid built transposed or one tile out fails. Seventy tiles, worst sample difference nought. The colour conversion is held to three things a hand-written one usually gets wrong: the studio range must reach real black and real white, a picture with no colour difference must come out grey at every level and in both matrices, and Cr must carry red rather than blue. The half-size colour planes are stretched by bilinear interpolation between sample centres, which for 4:2:0 means the chroma sample sits a quarter of a pixel up and to the left of the luma one. heif-convert cannot stand in as a whole-image oracle on this machine: libheif is installed but carries no HEVC plugin, so it reads the container and then decodes nothing. libheif-plugin-libde265 would fix that.

written by Jason Hoogland <hoogland@gmail.com>

Two in five of the photographs sampled carry lists of their own, so refusing them refused two in five of the library. They are now read: coded outright as a chain of differences, taken from an earlier list in the same set, or -- where a list names itself as its source -- taken from the default, which is the one case where "predicted from" does not mean "copied from". The corner value of the two largest sizes is coded on its own and kept on its own, and the sixteen and thirty-two sample matrices are the eight-sample one with each value covering two or four samples each way. Twenty-eight of forty photographs now decode, every one of them sample for sample against ffmpeg. The other twelve are JPEGs under a .heic extension and never reach the decoder at all.

written by Jason Hoogland <hoogland@gmail.com>

The syntax walk and the reconstruction, interleaved because they have to be: a block is predicted from its neighbours, so it cannot be predicted until the ones before it in coding order have been RECONSTRUCTED and not merely parsed. Twenty-four real HEIC photographs decode identically to ffmpeg's own decoder, luma and chroma, 262,144 samples each, no difference anywhere. The remaining sixteen of forty carry scaling lists of their own and are refused by name rather than decoded wrongly. Four faults found by that comparison, none of which any self-consistent check could have found: - The arithmetic decoder's OFFSET WAS UNSCALED at startup. This decoder keeps the next bits pre-read, so the offset must be shifted up by however many are in hand; putting the raw nine-bit value there left every comparison too small by a factor of 128 and the first hundred bins all came back as the more probable symbol. The interval-invariant test passes either way, which is exactly why it could not catch this. - Availability was "has this been reconstructed" rather than "is this earlier in decoding order". The four prediction blocks of one coding unit have their modes read before any of them is reconstructed, and each draws its candidates from the one before -- so every such block took the flat mode as its candidate and picked the wrong mode out of the list, with no change to the bin count. - A coding unit that carried a change of quantisation parameter also wrote a depth of nought over its own, and the next block's split flag was then read against the wrong context. - **The desync that took longest**: the quantiser delta is coded at the first transform unit with ANY residual, and a four-sample quad shares its parent's chroma flags -- so the first of four, with no luma residual of its own, is where it belongs. Reading it at the last of the four instead put those bins at the wrong point in the stream, and the picture from there on was decoded from the wrong bits. Two other real ones: the sao_offset_abs bound was 127 where the bit depth makes it 7, and entry point offsets count emulation prevention bytes (§7.4.7.1), so the cut into rows is made in the escaped data and each row unescaped after. The row-length check that localised the last of these stays: the encoder said how long each row of blocks is and the decoder has just read it, so the two must agree, and when they do not the error names the row.

written by Jason Hoogland <hoogland@gmail.com>

Thirty-five ways: planar, flat, and thirty-three directions, plus the three things that happen before a sample is predicted and each of which changes the answer -- substituting for neighbours that are not there, smoothing the boundary where the size and the direction call for it, and nudging the first row or column of the flattest modes towards what they abut. Every one of those carries a "not for chroma" or "not at thirty-two" or "not at four", and getting one wrong gives a picture that is ALMOST right, which then predicts the next block and the next. So each exception is a check of its own. The properties asserted are ones the implementation cannot fake. A uniform neighbourhood predicts a uniform block in all thirty-five modes at all four sizes, which catches interpolation weights that do not sum to thirty-two and a reference array read a sample out of step. The two forty-five degree directions shift the boundary by exactly one sample a row, so their answer can be written down without arithmetic. Planar is symmetric under swapping the axes. And planar does NOT reproduce an arbitrary plane -- the right and bottom edges are single samples from past the end of the two boundaries -- so the test that claimed it did was wrong about the codec rather than finding a fault, and says so where the next reader will look.

written by Jason Hoogland <hoogland@gmail.com>

The scaling that undoes the quantiser and the inverse transforms that undo the transform, which between them are the arithmetic every block goes through. Both published matrices are printed TRANSPOSED against the way the equation subscripts them -- a printed row is the second subscript and a printed column the first. A decoder that reads them the other way round still produces a picture, a wrong one, in a way no amount of staring at the table reveals. So the four-point inverses are written out in the test as the arithmetic anybody who has implemented one knows by heart, and that is what settles the orientation. Three more checks the decoder's own arithmetic cannot fake: every size of the cosine matrix is orthogonal to within the measured tolerance of the integer approximation (one part in 550 at sixteen points, the worst of the four); a block whose only coefficient is the direct one comes back flat at every size, which is what a stride worked out wrongly puts ripples into; and the six quantiser factors stand in the ratio of the sixth root of two, checked against the arithmetic they were built from rather than against anything here. The matrix itself -- 1,024 numbers -- is parsed out of the specification and compared entry by entry, the same discipline the context tables are held to. The last shift is the caller's, not the transform's: a skipped block takes a shift where the transform would have been and then the same one, which is what keeps the two paths in the same units.

written by Jason Hoogland <hoogland@gmail.com>

The arithmetic decoder could answer a bin against a context; what it had no way to say was which context. This is the other half: the eighteen sets of context variables an intra still picture draws on, their initialisation values for an intra slice, and the rule that carries them from one row of blocks to the next. They sit in one flat array with a base per set rather than a struct of named arrays, because every photograph in the corpus is coded in wavefronts and the whole lot is copied at the start of every row. Rows holds that rule: a row begins from the state saved after the SECOND block of the row above, and only the first row begins fresh. A decoder that treats a row boundary as a fresh start decodes plausible rubbish from the second row onward, which is why the rule has a test of its own before anything can exercise it. An index past the end of its set is refused rather than clamped. Reading the wrong context produces a picture rather than an error, and a picture that is subtly wrong is the hardest kind of fault to find. Two hundred and thirty numbers copied out of a document by hand, every one of which silently ruins a picture if it is wrong, so they are checked against the document rather than against the decoder that uses them: the test parses the published tables out of a text rendering of Rec. ITU-T H.265 and compares every entry, including the ranges Table 9-4 says an intra slice takes -- cbf_cb/cbf_cr at 0..3 and 12, transform_skip_flag at 0 and 3, sig_coeff_flag at 0..41 and then 126..127 with nothing between. Proven by putting one digit wrong in the largest table and watching it fail. Set HEVC_SPEC_TEXT to run it; it says so when absent rather than passing quietly.

written by Jason Hoogland <hoogland@gmail.com>

The CABAC arithmetic decoder: the three ways a bin is asked for -- against a context that adapts, bypassed at even odds, and the terminating bin that says where a slice or a row of it ends -- with the probability tables and the state transitions from H.265 Table 9-46 and 9-47. Two properties are asserted, since this is the last piece that can be checked before a picture comes out. Every context starts in a state the tables have: all 256 initialisation values against every quantisation parameter a slice may carry, including the negative ones a high-bit-depth picture allows. And the coding interval stays between 256 and 510 after every bin, over twenty thousand bins of arbitrary input -- a renormalisation one shift short satisfies neither and decodes plausible rubbish rather than failing.

written by Jason Hoogland <hoogland@gmail.com>

The slice segment header, and with it a fact that changes the shape of the decoder still to be written: every one of the 359 HEIC photographs measured is coded in wavefronts. The arithmetic decoder is reset at the start of every row of coding tree blocks, from the state saved after the second block of the row above, and the header carries a byte offset for each row. The first reading of this header treated the flag as something rare and refused all 359 files. What caught it is now an invariant the header enforces: under wavefront coding there is one piece per row, so the number of pieces the header names must equal the number of rows the sequence parameter set implies -- sixteen for a 512-pixel tile at 32, twenty-three for the 720-pixel picture. Those two numbers come out of different NAL units, so a header read one bit out of step cannot satisfy both. All 359 now read, none refused. The picture parameter set keeps four more fields for the same reason: the count of reserved header bits, whether an output flag is present, whether the deblocking settings may be overridden, and whether the loop filter crosses slices. Each decides whether a field exists in the slice header, and guessing any of them puts every field after it one place out.

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_graphics::hevc begins the decoder the HEIC work needs: NAL units out of a length-prefixed stream or an Annex B one, the emulation prevention undone, the hvcC record unpacked, and the sequence and picture parameter sets read. Nothing is decoded yet, and the parameter sets are the part that can be checked before a pixel exists: the size a sequence parameter set codes has to agree with the size the container's ispe property declares, and an encoder writes those two numbers from different places. Read against 359 real HEIC photographs: 359 parameter sets read, none refused, every size agreeing. The same pass says what the paths still to be written have to handle first. The corpus is uniform -- 8-bit 4:2:0, coding tree blocks of 32, the sample adaptive offset on, no PCM, no scaling lists, one tile -- and the tiles are 512 square in 350 files, 1024 square in eight, with one ungridded picture at 720. Anything else is refused by name rather than decoded approximately.

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_graphics::heif reads the half of HEIC that is not a codec: which item is the photograph, where its bytes are, the grid of tiles it is cut into, the decoder configuration those tiles are read with, and the Exif block the camera wrote. It decodes nothing, and it is written before any HEVC decoder because the two things a photograph library wants first are in the container rather than in the coded picture. The size is the reason. A reader that takes the first ispe box it meets gets the thumbnail's extent, since a phone writes the thumbnail's properties first; and where the photograph is a grid -- which every recent iPhone writes -- no ispe in the file carries the assembled size at all, only the grid item does. Both are resolved here by reading pitm and ipma. Measured over 359 real photographs against exiftool: no disagreement. The same 359 put through the first-ispe rule: 358 wrong. size() applies irot and extent() does not, and the difference is documented where both are: a phone writes irot and an Exif orientation that say the same thing, and a caller applying both lays a portrait photograph out landscape. Refused rather than guessed at: boxes that do not tile their parent, a grid naming the wrong number of tiles, an item whose extents fall outside the file, and a file that does not open with ftyp -- which is a fifth of the .heic files in one real library, being JPEG under another name.

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

The reverse lookup a note resolves through -- content in, file and spans out -- was a local of `render::notes`, and a flag names content too: its reader wants a line in a file rather than an offset into an operation. Lifted to `Placement`, public, built once and asked repeatedly, with `Repo::placement` as the way in. Content that renders nowhere is answered with no place, which is what lets a caller say so rather than invent a location. `NotePlace` is `Place`: the struct was always "where content renders in one file", and notes were merely its first caller. `notes` is now the lookup plus the note text and nothing else. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

Two people who rewrite one function body at once have their surviving base fragments interleaved with two insertions, in anchor and op order. That is convergent, conserved and attributed, and it compiles for nobody: the trial that found it called it the worst of the four things it found, and it is the last of them still open. The renderer arbitrates instead. Concurrent splices whose named content intersects form a graph -- one edge per pair the Overlap flag names -- and its connected components are the arbitration groups. Components contended by the same set of replicas over the same files are taken together, which is what stops two components of one file being won by different people. The member highest in op order prevails, and every member concurrent with it yields: its removals do not bury, and its own insertion is buried whole, so the region holds whole hunks and never an interleave. The slot is still placed, because a slot that has lost its claim shows nothing and stays as an anchor target, so anything anchored into yielded content still resolves. This is the shape the cross-file cycle already takes, and the shape §5.6 took before it. Two completions, both earned by a planted sweep of four thousand trials rather than argued for. A member in the winner's causal past does not yield, or a capture that emitted two hunks would void the winner's own first one. And yielding is transitive: a splice anchored wholly inside a buried insertion is buried too, or it renders as a fragment at a dead site with no flag firing for it, which is the same scramble one round later and smaller. Three things the sweep found that the rule as first stated did not say. The decision is the group's and not a pair's. Three authors in a chain put the first and the third in one group although they never named a common byte, so a flag saying "this operation rewrote your region" is false of roughly three yields in ten. Flag::Yielded therefore carries the group and its maximum, and a transitive yielder carries the buried insertion it sits inside, which closes the question of whether that case wanted a second flag code. The region is not a promise of one author. Where a third party has synced with one side of a collision and not the other it joins the group as the maximum, the exemption keeps the side it saw, and the region composes two authors' whole hunks. The exemption is load-bearing, so this is a consequence and not a defect; what is promised is whole hunks. Yielding is not only subtractive, and the merge is not monotone. Where the loser deleted text the winner did not, that text comes back and the render is larger than it was; and merging two components changes a winner, so an edit separate components would have buried can be revived by the exemption. Both are expected, both have a case. Flag::Overlap stays, in the relation Demoted has to Confined. It is the only flag that says which two operations actually met, and it fires over a move as well as a splice, where the arbitration is deliberately confined to splices. The wire is additive: one flag code, no ORESNP bump, no operation body, no encoding change, and frozen snapshot bytes carry no flag of a kind that did not exist when they were written. The overlap decision folds into the cross-file cycle's fixed point rather than beside it, since yielding changes the tombstones and the tombstones are what a trial layout shows the cycle rule. Thirteen cases transcribed from the sweep, every expectation that sweep's own render, each under every delivery order with conservation checked on all of them; and a planted sweep that asserts the rule fires at all and leaves no fragment at a dead site. Both completions were switched off in turn to confirm the cases catch their absence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

The parser reads git's fast-import stream because that is the one interface git maintains for foreign consumers of a repository. The same sentence holds for a producer, so an emitter joins it: a history spelled as this stream becomes a git repository without this crate ever learning what a packfile is. It shares the parser's vocabulary rather than declaring a second one, so a stream parsed and re-emitted is expressible in the type system, and it keeps the parser's posture of refusing what it cannot say. That posture earns its keep here. Handed a path that is both a file and a directory, git takes the stream, keeps the directory and drops the file without a word -- measured against git 2.53.0, not assumed -- so the emitter refuses that tree by name before a byte goes out. A path holding .git aborts git part way through with a crash report and a half-built repository, so it is refused too, along with an absolute path, an empty component, a trailing separator and a NUL byte. Nothing here spawns a process or reads a clock. Emitting bytes is pure, the crate still compiles for wasm32-unknown-unknown, and running git over what comes out is the caller's business. The tests run both ways: the unit tests read the emitted stream back through the parser, which proves the two halves agree and no more, and a gated test pipes it into a real git fast-import and compares the checkout byte for byte and mode for mode. One of those measures git's own silent drop, so the refusal is answering something real. Another pins the property a mirror will be checked against: a tree object is a hash of content alone, so the same content gives the same tree name under a different message and date, while the commit name does not. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

The rule for sizing a sketch -- the two logs' difference in length plus a fanout for every head either frontier carries, and the walk where that guess reaches the smaller log -- lived in one caller. A second peer that runs the same session now needs the same answer, and a rule copied is a rule that drifts. A guess of nothing means two empty logs, and those get the walk rather than a sketch of nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PR2Vb7FdgfMiVLMg5pL6Xb

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

The parser has always read all five. Three of them name a file with bytes in it and now have somewhere to go; a gitlink and a directory entry name something that is not this repository's file at all, and there is nothing for a FileMode to say about either. So the answer is an Option and not an error. What to do about a submodule -- refuse, or leave the entry out -- is a decision, and the consumer is the one holding the path and the commit the message would have to name, so the consumer makes it rather than being handed a guess.

written by Jason Hoogland <hoogland@gmail.com>

ORESEG goes to 3. Not a byte of the framing moved: what the version declares is which operations the records inside may be, and there is one more of them than there was. Version 2 stays readable, which the v1 to v2 bump could not offer. Version 3 is a strict superset -- same framing, one code added on top -- so every segment ever written under 2 means under 3 exactly what it meant under 2, and no repository owes a migration for this. What the bump buys is the better refusal: a reader meeting a version it does not know says which version it met, rather than reporting an operation code it cannot place, and that is worth the one byte it costs. A writer continuing somebody else's segment now keeps that promise rather than merely intending it. Appending a FileMode to a version 2 segment would leave a file whose header offers a vocabulary its records exceed, so the writer refuses and names both the operation and the version; a caller with such a record to write starts a segment at the current version, nothing having ever said that a log's segments share one. The frozen bytes are re-pinned. The one-record fixture moved a single byte, the version, since it carries a mark and a mark's encoding has never changed. A second fixture pins the FileMode itself, so the operation the bump exists for has its spelling on the record too.

written by Jason Hoogland <hoogland@gmail.com>

An imported script that cannot be run is not the script that was imported, and the executable bit was the one thing a whole history still lost. So the vocabulary gains Op::FileMode at wire code 8: it names a file by identity and asserts its mode, exactly as a rename names a file by identity and asserts its path, so the assertion survives every rename and every edit the bytes go on to have. The mode is three values and not a number -- normal, executable, symlink -- and normal is the default, which is what makes the operation additive: a file no FileMode ever named is a normal file, so every history written before today means today what it meant yesterday. A symlink is then git's own model verbatim, a file whose bytes are the target. Two written concurrently settle where two concurrent renames settle, by operation order, and that comes for nothing: the render reads the lifecycle operations in op order already. The file listing every convergence case is checked against now shows a mode where it is not the default, so all of them prove the mode is a function of the operation set rather than of the delivery order. ORESNP goes to 4 to carry it. A snapshot exists so that a checkout need not replay the log, and a checkout that could not tell a script from a text file would write out a tree the history does not describe. Old snapshots are refused rather than misread, which costs nothing: nothing is lost by discarding a snapshot.

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

VhostConfig and VhostRuntime are built by hand in tests/server.rs, so a new field is a compile error there rather than a default. It has none. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

data_url.rs held a percent decoder as a private function, so anything else needing one -- a query parameter, a name carried in a token a browser wrote -- had to write its own. http::pct decodes bytes, decodes text, and encodes a component escaping exactly what encodeURIComponent escapes. That match is the point: a value a browser wrote and a peer reads must survive the trip byte for byte, and the browser's rule is not ours to choose. The expected strings in the test are what a browser console prints. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

A site whose pages, files and API stay with Steel had no way to hand a single endpoint to a separate process. The only forwarding on offer was a proxy_route, which claims a path prefix and everything under it, so a gateway at /ws meant either moving the whole site behind the proxy or teaching Steel the gateway's protocol. A ws_route names one exact path and a ws:// upstream. On an upgrade to that path Steel forwards the handshake, relays whatever the upstream answers -- a 101 or a refusal, verbatim -- and then copies bytes both ways until an end closes. It never parses a frame, so the two ends are free to agree on a sub-protocol, extensions and message sizes without this hop being told. A request to the same path that is not an upgrade falls through untouched. The relay itself moves to srv::wsproxy, which handle_proxy_websocket now calls: the two kinds of route differ in how they match a request, not in what forwarding a handshake means. ws_routes is checked first, an exact path being more specific than a prefix that contains it. wss:// is refused with an explanation rather than spoken as plaintext. This forwards to a server on the same machine; an operator who needs TLS to the upstream is not describing loopback. The upstream in the tests is fe2o3_net's own websocket machinery rather than a stub, so the accept value the client checks is one the upstream computed from the key the client chose -- which is what a browser will do. Dropping the Sec-WebSocket-Key from the forwarded headers fails two of them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

Dat::json puts a space after every colon and comma. That is easy to read and it is not what a browser's JSON.stringify writes, so a peer verifying a signature a browser made over a JSON object could not reconstruct the bytes that were signed. Dat::json_canonical follows RFC 8785: no whitespace outside strings, object members ordered by their keys' UTF-16 code units, and the escapes the scheme fixes. It refuses what it cannot promise -- a float, whose canonical form defers to ECMAScript's number serialisation; an integer past 2^53 - 1, which a JavaScript signer cannot hold and so cannot have signed; bytes and the rest of the daticle catalogue, each named in the error. The ordering test carries the members of the RFC's own example, whose point is that the order is neither the written one nor a byte-wise sort of the escaped keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

ecdsa.rs could check what a browser produced and produce nothing itself, so a Rust client of a gateway that authenticates device keys had nowhere to go, and a test presenting a real signature had to reach into ring. P256KeyPair generates or loads a key, hands back the 65-byte uncompressed SEC1 point WebCrypto's exportKey('raw') yields, and signs to the 64-byte r || s form verify_p256_sha256_fixed takes. The PKCS#8 bytes are retained because ring consumes them on load and a key that cannot be written down cannot be reloaded. The loader is checked against openssl: the test key's x and y are the values the DER's own documentation derived with it, not values this crate computed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

A server that owns its socket -- reads the upgrade request itself, then splits the stream so one task writes what another task's reads provoke -- could not use ws::core at all. WebSocket carries five type parameters describing a database it never touches on the framing path, and the framing lived inside its methods, so the only way to get a frame on the wire was to name an Encrypter, a Hasher and a Database first. The three operations that need none of that are now free functions, and WebSocket's methods are what calls them: accept_response builds the 101 from a request (validating the key rather than digesting whatever arrived), encode_message turns a message into frame bytes given only whether this end masks, and read_message decodes one message from anything that reads. A first frame carrying the continuation opcode used to reach an unimplemented!() -- a panic a stranger could provoke on a server. It is now an error, which is what a peer sending nonsense deserves. The second unmasking pass over an already-copied payload is gone with it; it wrote to a buffer nothing read. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5xSadrETfJ1yGtTXJjCZQ

written by Jason Hoogland <hoogland@gmail.com>

The file still named PostKind, removed when authorship and categories replaced it, so the whole suite failed to compile and its nine tests -- the only ones that put a post through a real database -- have not run since. No test body changed; the two record literals now carry the fields the record now has. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

The coding checks added beside the HEAD sweep compared `Content-Length` against `stat` of an HTML file, and the rig runs Steel in development mode, where a document is rewritten on the way out to carry the refresh hook. The file on disk was not the entity being sent, so `stat` was the wrong oracle and two checks failed on behaviour that was right. A stylesheet instead: `text/css` is compressible and is not a document, so what is on disk is what goes out. The whole sweep is green, and the GET's own length is compared to the HEAD's rather than only to the file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

`/asides/` answered 404 while `/asides` rendered, so a reader who typed the slash, or followed a link that carried one, was told the blog did not exist. A directory-shaped URL is what most of the web looks like; the distinction was nobody's intent. A 301 to the canonical spelling rather than serving both, so the prose keeps one address -- two URLs for one page split a reader's history, a shared link and a search engine's idea of where the piece lives. Posts get the same treatment, being the same mistake one path deeper. The query is carried across so a chip link still lands narrowed, but only when every character of it is printable ASCII: it came off the request line and it is going into a `Location`, which is the shape a response-splitting attempt takes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

The tag block was suppressed where no post carried a tag and the category block was not, so a blog whose posts carried neither drew the whole configured taxonomy over the same nothing the tags had declined to draw anything over. Every chip in it narrowed the list to zero, which is a row of controls that can only disappoint. A config's categories are a vocabulary the site may file under, not a claim that anything is filed. Where something is filed, the whole vocabulary is still offered: what a reader may narrow to is what the site offers, not only what the posts in front of them happen to wear. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

One line served both states. A blog with no posts said "Nothing here yet.", and a filter that had excluded every post revealed the same line -- so narrowing too far read as a blog with nothing in it, and the way out of that is to widen the filter, which is the one thing those words do not suggest. Two states, two lines. The server draws the first and decides whether it shows, knowing whether there are posts; the script shows the second, knowing whether a filter left any, and never touches the first. The wording is the PWA's, so the two readers say the same thing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

Six surfaces call `cache::generated` and one of them was tested, so a refactor dropping any of the other five would have gone out silently -- and what it costs is an author forcing a refresh to see their own post, which a reader would never think to do. `cache::assert_not_held` puts the invariant in one place, and the tests of the publish index, an empty index, a post, a post that does not exist, the Atom feed, a console page, the two not-yet-an-admin pages, the console's JSON, its JSON error, its CSV export and its unknown-route `404` all say the same thing through it. The two served scripts are checked the other way, since those are held on purpose. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

RFC 9110 15.5.5 makes a `404` heuristically cacheable, which is the one class of answer that must never be held: what is missing now is exactly what somebody is about to add. The concrete symptom was an avatar -- a byline asked for a picture before its owner had uploaded one, the browser kept the miss, and the picture they then chose never appeared for them. Every `404` this handler produces goes through `cache::generated` now: the missing avatar, the two dashboard-not-configured answers, the three static-file misses, and the console's unknown-route fallback. The `500` beside them and the `303` are left alone, being uncacheable already. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

The reason a comment claiming a known commenter from a new address is held was a literal wrapped across two lines with no continuation, so three tabs of source indentation sat inside the string and the moderation queue read "commented from before". Nothing about the judgement was wrong and nothing tested the words. It is a const now, since a reason is shown to a person and is worth being able to test, and the test gathers every reason the moderator can give: no tab, no newline, no run of spaces, nothing padded. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

`import_dir` took the date out of the filename and kept `None` where there was no `YYYY-MM-DD-` prefix, so a directory of plainly-named files landed in the store undated -- and the feed, which must say when every entry was updated, dated each of them to the epoch. That files the whole import under 1970 in every reader that takes it, silently. The composer's save has dated an empty field to today since the epoch bug was found. The import writes the same records by another route, so it gets the same fallback: a fix on one path and not the other is the same bug with a different way in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

`Handle::current` panics where there is no runtime, which is an `unwrap` by another name: the two blocking tasks that read a file and encode a body each called it, and a panic in a pool thread reaches the caller as a `JoinError` saying only that the task did not finish. `try_current` gives an error that names what was missing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

RFC 9110 14.2 defines range handling for GET alone and requires a server to ignore the field on any other method. A HEAD shares the GET's dispatch branch here, so it was reaching `range::resolve` and being answered 206 with the length of a window -- naming bytes nobody can read and understating the size of the thing being asked about, which is the one fact a HEAD exists to report. `head_only` was already in `loc.data` for the read tally, so it is read once at the top of the branch and both uses take it from there. The rig's HEAD sweep asserted the old behaviour, so it is inverted; while it is open it also gains a page worth encoding and the coding checks that go with it, which prove at the wire what the encoder was just told about a HEAD. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

A HEAD of a compressible page read the whole of it off the disk, gzipped it, and then withheld the body at the wire -- paying for the read and the compression of bytes nobody receives. The cost falls on exactly the requests that were meant to be cheap: an uptime monitor asking the size of a large page, once a minute, forever. The rule belongs in `is_encodable`, which is the one authority on whether a response may be coded, rather than at the call site: a message whose body is deliberately withheld has nothing to encode. Of the two answers RFC 9110 9.3.2 allows -- the identity `Content-Length`, or the chosen coding with no length at all -- this takes the first. It is what a GET accepting no coding would be told, it is what anyone asking how big a thing is wants to know, and it needs no way to suppress a `Content-Length` that `write_all` derives from the body by construction. `Vary` is still set, because a store keyed on the URL alone would otherwise hand this answer to the next client along. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016P1hR8YmGDyEZ6Wekg8K37

written by Jason Hoogland <hoogland@gmail.com>

fe2o3_geom::proj carried only Equal Earth, which draws the whole world at once. A caller wanting a globe a viewer turns needs the other kind: the sphere seen from infinitely far away, with the far hemisphere behind the near one. orthographic() takes the latitude and longitude the viewer is above and returns the point on the disc. orthographic_cos_c() answers which side of the globe a position is on -- one under the viewer, zero on the horizon, negative behind. The two are separate because the formula cannot tell a far position from the near one in front of it, and a caller clipping a coastline wants to interpolate an edge to the horizon rather than be handed a hole. Nineteen test vectors from PROJ 9.7.1's +proj=ortho at two centres, one of them oblique in both coordinates. PROJ answers `*` rather than a coordinate for the far hemisphere, and that refusal is what the cosine is checked against. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WshScW5JbJWEePekcGhsHm

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

The self-hosting trial's two silent rounds were one hole: an edit made concurrently with a deletion renders nowhere a reader looks, or as a stranded fragment, and the flag vocabulary had no name for either. A reviewer reading clean flags would ship a tree that quietly dropped a teammate's work from sight. Two flags close it, both judged by the parents as Overlap and Torn are. Stranded names a splice whose every anchored neighbour was deleted by a concurrent operation -- which is what a capture-side delete-plus-insert "move" does to a concurrent edit inside the block -- and names the deleter beside it. SplicedIntoDeleted names a splice concurrent with the FileDelete of the file its content landed in, beside that deletion. In both, a deletion causally ordered with the edit is a decision rather than a race and raises nothing; and a move into a deleted file remains MovedIntoDeleted's territory, which is unchanged. The rendered bytes are untouched -- this is reportage, not placement -- and the snapshot carries the new kinds the way it carried Confined and Won when they were added: two more codes in the same self-describing list, under the same format version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTEk5Ts7rqP3BhrM2vbmoj

written by Jason Hoogland <hoogland@gmail.com>

written by Jason Hoogland <hoogland@gmail.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTEk5Ts7rqP3BhrM2vbmoj

written by Jason Hoogland <hoogland@gmail.com>

The example served INBOX alone, so a client exercising folder listing had nothing to list. It now creates Sent, Drafts, Archive, Junk and Trash -- the five roles the server's special-use table already recognises -- plus an ordinary nested folder with a space in its name, and seeds mail into three of them, so LIST answers with the shapes a real mailbox produces. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016aLFQ6EN327KH7HEokRPq2

written by Jason Hoogland <hoogland@gmail.com>

An MP4 writer: ftyp, moov with one video track's whole sample table, and mdat, around samples and an avcC record the caller's encoder produced. The moov goes first, so a reader has the index before the media, which costs a second pass over the box tree because the chunk offsets are absolute. It refuses rather than emitting a file that is well formed and unplayable: no samples, a zero timescale or duration, a truncated configuration record, a first sample that is not a sync sample, dimensions that disagree with the sequence parameter set, and a sample whose bytes are not tiled by the NAL lengths the record declares. The samples the oracle test uses are FFmpeg's. It demuxes an elementary stream, re-muxes it here, and requires the decode of the result to be identical byte for byte to the decode of the source; FFprobe, ExifTool, GStreamer's qtdemux and a box walker written to the specification each read the file back. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKYf8jp6Uq7x4HHnWC4KWu

written by Jason Hoogland <hoogland@gmail.com>

Paint was a flat colour, so a drawing that shades a solid body -- which is most of what makes a rendered figure look like an object rather than a diagram -- could be described in an SVG and not drawn into a pixmap. Gradient is the two cases worth having, linear along an axis and radial from a centre, and Pixmap::fill_gradient is the existing fill under a paint that varies. The gradient is expressed in the path's own coordinates, so a shape and its shading scale and rotate together. Reading it needs the pixel's centre carried back where the shape was defined, which is what Transform::invert is for. A transform that has collapsed the plane onto a line has no inverse, and there the fill takes the last stop's colour rather than failing: the shape is still there to be filled. Sorting the stops rather than believing their order, padding at both ends, and refusing a gradient with no stops or a radius that is not positive, all happen once in prepare and not at a pixel. The sampler and tests written beside it would agree with each other about a position measured across the axis rather than along it, or a radial position taken as a squared distance. So five fixtures in tests/gradient/ are rendered by Chromium and compared premultiplied, because the browser's own buffer was: worst channel one level, mean a tenth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKYf8jp6Uq7x4HHnWC4KWu

written by Jason Hoogland <hoogland@gmail.com>

A frame sequence had nowhere to go: the codec wrote one picture, and a compile target that walks a state chain produces hundreds. Animation takes them one at a time and writes an APNG, storing only the rectangle in which each frame differs from the last -- so a figure crossing a still background costs the figure. Five seconds of a 960 by 540 explainer comes to 1.2 MB, which is 44 per cent of the same frames written loose. The file is a PNG first. Its default image is its first frame, so a reader that knows nothing of the animation chunks shows that frame and reports no error, which is the whole point of how the format is laid out. encode's filtering and deflating is now deflate_region, since a frame is a rectangle of a pixmap and a still is the rectangle that happens to be all of it. The unit tests check the chunk order, the sequence numbers and the difference rectangle, all of which the encoder and its tests could agree about while the file failed to animate. So FFmpeg and Pillow decode it in tests/apng_oracle.rs, and the pixels compared are the ones the frames were filled with before anything ran. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKYf8jp6Uq7x4HHnWC4KWu

written by Jason Hoogland <hoogland@gmail.com>

LIST now appends RETURN (SPECIAL-USE) when the server advertises the capability, and MailboxInfo::special_use() maps the RFC 6154 attributes to a SpecialUse enum. The point is localisation: a client cannot recognise the Sent folder of a German Gmail account by its name ("[Gmail]/Gesendet"), but the \Sent attribute spells the role the same everywhere. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016aLFQ6EN327KH7HEokRPq2

written by Jason Hoogland <hoogland@gmail.com>

MAX_LINE_SCRIPT caps the Myers pass on both routes, and on one of them the pieces are not lines. MAX_PIECE_SCRIPT, which is what the Myers pass has always been counting. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PcfVQ5V2YnwJJwyVPYn5gg

written by Jason Hoogland <hoogland@gmail.com>

It returned an Outcome and never used it. A signature that claims a failure mode it does not have costs every caller a res! and tells a reader to look for an error path that is not there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PcfVQ5V2YnwJJwyVPYn5gg

written by Jason Hoogland <hoogland@gmail.com>